SAFEDOR D 04.05.02 2005 10 21 DNV RiskEvaluationCriteria Rev 3

S A F E D O R
D.4.5.2
Project No.: IP-516278

Project SAFEDOR
Acronym:
Project Title: Design, Operation and Regulation for Safety
Instrument: Integrated Project

Thematic Sustainable Surface Transport
Priority:
Risk Evaluation Criteria

D.4.5.2
SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-rev-3.0
Due date of Deliverable: 2005-04-30
Actual Submission Date: 2005-10-21
Rolf Skjong, Erik Vanem and Øyvind Det Norske Veritas AS

Endresen
-document author- -organization name of lead contractor for this deliverable-
Erik Andreassen and Rolf Skjong FINAL
-document approved by- -revision type-
2007-10-24 PU - Public
-date of last update- -distribution level-
Project co-funded by the European Commission within the Sixths Framework Programme (2002-2006)
SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 1 of 117

SAFEDOR Date 2007-10-24
D.4.5.2
Disclaimer
The information contained in this report is subject to change without notice and should not be construed as a commitment by
any members of the SAFEDOR Consortium or the authors. In the event of any software or algorithms being described in this
report, the SAFEDOR Consortium assumes no responsibility for the use or inability to use any of its software or algorithms.
The information is provided without any warranty of any kind and the SAFEDOR Consortium expressly disclaims all implied
warranties, including but not limited to the implied warranties of merchantability and fitness for a particular use.
(c) COPYRIGHT 2005 The SAFEDOR Consortium
This document may be copied and reproduced without written permission from the SAFEDOR Consortium. Acknowledgement
of the authors of the document shall be clearly referenced.
All rights reserved.
Document History
Document ID. Date Description
SAFEDOR-D-4.5.2-DNV-Rev-1 2005-09-15 DRAFT
SAFEDOR-D-4.5.2-DNV-Rev-1 2005-09-29 FINAL DRAFT

SAFEDOR-D-4.5.2-DNV-Rev-2 2005-10-21 FINAL
SAFEDOR-D-4.5.2-DNV-Rev-3 2007-10-24 Updated chapter on CATS

D.4.5.2
Document Control Sheet
Title: Risk Evaluation Criteria

Executive summary:
This report discusses various risk evaluation criteria with relevance to shipping and ship design. In
particular, risk acceptance criteria for safety and environmental damage are considered. The report
contains a review of existing criteria and discusses current practice within IMO. In addition, new
proposals are presented in areas where risk evaluation criteria have not been commonly used, e.g. in
cost effectiveness criteria for risk control options related to environmental risk.
The work with this deliverable started shortly after the SAFEDOR kick-off meeting in February 2005
and was completed September 30th 2005. The report consists of three major chapters, chapter 2, 3 and 4.
Chapter 2 contains a description of general principles on how risk evaluation criteria may be derived.
Of particular relevance to risk based design and the work within SAFEDOR are the ALARP principle
and the principle of equivalency. Various risk acceptance criteria are generally needed in order to assess
an activity in terms of risk. First, limits for when the risk is intolerable should be established. It will
also be useful to define a limit for when risks are regarded as negligible. Then, cost effectiveness
criteria should be decided upon in order to evaluate whether risks are ALARP if in the ALARP area.
The principles discussed in chapter 2 are applied to safety in chapter 3 and to accidental environmental
releases in chapter 4.
Chapter 3 largely relies on work done prior to SAFEDOR, and was reported in e.g. an INTERSHIP II-2
report in 2004 [1]. This part has only been subjects to some updates, accounting for recently published
papers and results. The chapter discusses various risk acceptance criteria related to safety for individual
risk and societal risk. The main focus is on fatality risk, but also the risk of non-fatal injuries and ill
health is covered. Furthermore, cost effectiveness criteria in terms of the value of preventing a fatality
are considered. A review of actual cost effectiveness in previous life saving interventions is also carried
out.
The major new research reported is in Chapter 4, containing the risk evaluation criteria for accidental
releases to the environment. Whilst there has been some general agreement on risk evaluation criteria
for safety, no review or proposal has been presented for general use in IMO FSA studies or in risk
based designs relating to environmental risk. This issue was in the terms of reference of the IMO FSA
working group at MSC 80 (May 2005), and the work with this chapter therefore started after MSC 80.
However, as no proposal was submitted to IMO this topic was not debated in any detail and was put on
the terms of reference of the correspondence group FSA working intersessionally between MSC 80 and
81 (May 2006). This deliverable may therefore be made available to the correspondence group and
submitted to MSC 81.
In addition to the three main chapters, this report also contains a number of smaller chapters, i.e. an
introduction, a chapter covering economic and property risk, a chapter covering various other issues
and recommendations. This is supplemented by a comprehensive list of references and a number of
annexes that outlines certain issues in more detail.
Use of risk evaluation criteria is crucial for SAFEDOR. Without such agreed criteria, risk based design
can only be carried out based on safety equivalency considerations. This result in strong restriction on
the use of risk based design and it result in doubling the work. To demonstrate safety equivalency the
designer first has to find the inherent safety in existing designs that has been approved according to
current regulations. Thereafter the same model, similar assumptions and scenarios are used to
demonstrate that the new/innovative design is as safe as or safer than the design following the
traditional approach.

D.4.5.2
The risk evaluation criteria for safety have been used extensively over the last few years, and a lot of
experience with their use now exists. For environmental risk this is not the case. The criteria have only
been compared to previous decisions (OPA 90). The criteria should also be tried out on practical risk
based design. This will take place in WP 6.9 in SAFEDOR.
Work carried out by Approved by
Rolf Skjong, DNV Eirik Andreassen

- name of internal reviewer -
Erik Vanem, DNV - signature on file -

- signature of internal reviewer and date of acceptance -
Jeppe Juhl (DMA)
Øyvind Endresen, DNV
- name of external reviewer (WP-leader)-
- signature on file -
- signature of external reviewer and date of acceptance -

D.4.5.2
Contents
1 Introduction .......................................................................................................................................... 7
1.1 Scope of risk evaluation criteria.................................................................................................. 7
1.2 Risk acceptance criteria .............................................................................................................. 8
1.3 Individual versus societal risk acceptance criteria ...................................................................... 9
2 Principles for establishing risk acceptance criteria for safety ............................................................ 10
2.1 Absolute probabilistic risk criteria............................................................................................ 10
2.2 The ALARP principle ............................................................................................................... 10
2.3 The principle of equivalency..................................................................................................... 11
2.4 Comparison with known hazards.............................................................................................. 11
2.5 The principle of maximum net benefit to all and the Life Quality Index ................................. 11
2.6 Voluntary risk reduction measures ........................................................................................... 12
2.7 The accountability principle...................................................................................................... 14
2.8 The holistic principle ................................................................................................................ 14
2.9 Acceptance criteria based on a combination of different principles ......................................... 15
3 Risk acceptance criteria for safety...................................................................................................... 17
3.1 Individual risk ........................................................................................................................... 17
3.2 Societal risk............................................................................................................................... 19
3.3 Value of preventing a fatality ................................................................................................... 21
3.4 Cost effectiveness in actual life saving interventions ............................................................... 24
3.5 Non-fatal injuries and ill health ................................................................................................ 34
4 Environmental risk acceptance criteria .............................................................................................. 37
4.1 Risk exposure from shipping .................................................................................................... 38
4.1.1 Transportation of radioactive material by sea ...................................................................... 41
4.2 Status at IMO ............................................................................................................................ 42
4.3 Precautionary principle ............................................................................................................. 43
4.4 An alternative proposal ............................................................................................................. 43
4.5 Cost-effectiveness criteria for oil spill prevention and mitigation............................................ 46
4.5.1 Oil inputs into the marine environment ................................................................................ 46
4.5.2 Accidental release of oil into the sea .................................................................................... 50
4.5.3 The costs of oil spills ............................................................................................................ 53
4.5.4 Cost data used for establishing acceptance criteria .............................................................. 57
4.5.5 Criteria for implementation of oil spill risk reduction measures .......................................... 60
4.5.6 Cost effectiveness of existing regulations ............................................................................ 63
5 Economic and property risk acceptance criteria................................................................................. 68
6 Other issues ........................................................................................................................................ 69
6.1 Updating acceptance criteria..................................................................................................... 69
6.2 Depreciation of future costs – Interest rates.............................................................................. 69
7 Recommendations .............................................................................................................................. 71
8 References .......................................................................................................................................... 73
Annex A: Descriptions of risk control options........................................................................................... 80
Annex B: FN based acceptance criteria...................................................................................................... 90
Annex C: Method for deriving societal risk criteria................................................................................... 92
Annex D: Alternative design of oil tankers................................................................................................ 94
Annex E: Risk Matrices ............................................................................................................................. 98

D.4.5.2

D.4.5.2
1 Introduction
1.1 Scope of risk evaluation criteria

Risk evaluation criteria are useful for defining the exact format of the parameters used for decision
making. They both define how risks are measured (the metric), the level of risks that are acceptable, and
the level of investment in risk reduction that are deemed necessary. Whilst the decision maker may
consider other issues not included in the risk assessment, there are great advantages clarifying the rational
basis for the decision through the agreement on evaluation criteria. The risk analyst than knows how to
present the result of the analysis and the decision maker can accumulate experience with the criteria and
which type of risk control options are necessary. The decision maker can compare previous decisions
with current and potential future decisions and gradually make decisions that a consistent over both time
and disciplines.
The risk analysis itself has a limited scope. Risk analyses are only necessary when there are events that
may be associated with certain probabilities and consequences. For regular minor losses or regular
releases there is no need for using the risk analysis as a tool, because the loss may be predicted directly
from the data. For example, regular releases of CO2 or NOX can be estimated for a ship without a risk
analysis. However, an analysis of increases of global temperatures by the combined releases of green
house gases could be done by a risk analysis (probability of increasing the temperature by 2˚C and the
consequences). Whether a risk analysis is useful or not is therefore a result of what is defined as the
object of analysis (e.g. ship or global climate) or the system and its boundaries. In particular for
environmental risks the distinction is important. An environmental risk analysis for a ship is focused on
identifying risk control options to be applied at ship level, whilst a risk analysis for a habitat is focused on
risk control options that could reduce the risk to the habitat from exposure of pollution from many sources
(where a ship accident could be one). From this discussion it may be concluded that the scope of a risk
analysis and the format of risk evaluation criteria will be a direct consequence of the possible decisions
and the authority of the decision maker. For example, a ship may have implemented all cost effective risk
control options for trading internationally, still being unacceptable for sailing close to some valuable
habitat. This generally leaves only the option of requiring higher standard ships in the area or excluding
all ships from sailing in the area. The scope of the risk evaluation criteria described here are the ‘generic
ship’ as described in [13].
Based on a study of the material described in this report, it is evident that many different alternatives can
be chosen as potential “risk evaluation criteria” for the maritime community. However, it would be
desirable for IMO to standardise decision parameters including risk acceptance criteria as far as possible.
By reaching agreement on which risk acceptance criteria to use, Flag States and NGOs intending to
submit an FSA study to IMO, will know the format of the information needed. Furthermore, this will
facilitate comparison between alternative proposals, and comparison with earlier decisions.
Standardisation of risk acceptance criteria would also strengthen the motivation behind introducing FSA
into the work of IMO; i.e. further contribute to a decision making process in IMO which is transparent,
consistent, systematic and scientific.
Equally important, the development of agreed risk evaluation criteria will also contribute to more
consistent and predictable acceptance of equivalency, as safety equivalency may be proven according to
known and accepted safety standards, and the same criteria as used in IMO may in practice be used in
design in cases of innovative design that deviates from the standard designs covered by IMO conventions
and the Classification rules. The designers should not be left with the decisions of defining criteria based
on own experience, as this may deviate from the criteria intended by the regulations.

D.4.5.2
Risk assessment criteria are used when deciding on implementing risk control options in the form of
regulatory instruments (IMO conventions, Classification rules, other industry standards). They are not
applicable in operative decision relating to saving life or reducing maritime pollution. For example, the
criteria are meant to be used in decisions relating to life saving appliances, but not in decisions relating to
initiating a search and rescue operation. In a rescue operation it is expected that available resources are
used to save life, without considering the costs.
The risk acceptance criteria do not consider implementations issues within the maritime industry. It has
been demonstrated by OECD that one of the problems with the implementation of the regulations relates
to the economic benefits by non-compliance. The situation is simply that in some cases the cost of
compliance exceeds the risk of non-compliance (the probability of non-compliance being detected
multiplied with the value of the time-loss and the fines should non-compliance be detected). The solution
is here either to increase inspections and surveys (increase the probability of detection) or increase the
penalties for non-compliance or both [2].
This report describes criteria used for safety (loss of life, limb and health) and harm to the maritime
environment (currently limited to accidental releases of oil and oil products). The criteria may be briefly
summarized as in chapter 7.
1.2 Risk acceptance criteria

Nearly all activities in life involve risk in some way or the other, and there is no universally agreed
criteria for what levels of risk are acceptable. Nevertheless, identified and unidentified risks are always
sought to be controlled, i.e. minimized. The most commonly used strategy for managing risk in the public
interest is through legislation and regulation, although everyone is constantly voluntarily managing
personal risk in daily life on an individual level, both consciously as well as unconsciously.
However, risk reduction will generally come at a price and it will be necessary to trade-off between the
level of risk one accepts to be exposed to and the cost one is willing to pay to mitigate the risk. For
decision-makers responsible for the safety of the public, at the expense of the wealth of the public, this
trade-off needs to be considered carefully and thoroughly. The overall objective is always to best allocate
the society’s limited resources for risk reduction, by supporting the implementation of efficient risk
reduction measures and to avoid wasting efforts on inefficient ones. I.e. resources spent on ineffective
safety measures could yield better results, if spent differently.
Risks introduced to the society from a given activity may be of different types. Fatality risks or health
risks are the risk of depriving members of the community of their lives or their good health because of the
activity. Other types of risks are property risk, economic risk and environmental risks, i.e. the risk of
accidents or pollution with negative environmental consequences. When decisions about safety are made,
all these risks should be considered, and appropriate acceptance criteria for fatality, health,
environmental, economic and property risks should all be met before an activity is to be declared safe
enough [1].
Safety is surely an important objective in society, but it is not the only one and allocation of resources for
improving safety must be balanced with that of other societal needs. When discussing the balance
between cost and risk, one soon enters the realm of philosophy, and several different approaches can be
taken. In the literature, different fundamental principles for arriving at the most appropriate risk
acceptance criteria have thus been proposed, e.g. in Nathwani and Narveson (1995) [4], Skjong and
Ronold (1998) [5], Nathwani et al. (1999) [6], Pandey and Nathwani (2004) [7]. Extensive research in
this field is continuously going on, and new principles for establishing and evaluating criteria are
continually being introduced. For example, in [8], the following five principles for good regulation are
established:
D.4.5.2
• Proportionality
• Accountability
• Consistency
• Transparency
• Targeting
Having adopted a set of fundamental principles to govern the establishment of risk acceptance criteria,
specific risk acceptance criteria can be formulated. In the following, a brief overview of existing and
emerging principles for establishing risk acceptance criteria are given as well as some existing and
proposed criteria for what levels of risk are to be regarded as tolerable
1.3 Individual versus societal risk acceptance criteria

Depending on the system under consideration, both individual and societal risk acceptance criteria might
apply. For large systems exposing a large number of people to risks, and where a large number of people
are affected by possible accidents, societal risk acceptance criteria are deemed to be most appropriate. In
general, societal risk is expressed in terms of frequency versus number of fatalities, and two of the most
commonly used methods of describing such risks are risk matrices or FN-curves. Risk matrices and FN
diagrams will also indicate what levels of risks are acceptable and what is not. Potential Loss of Lives
(PLL) is another measure of societal risk for a defined system or activity. Societal concern is a related
concept to societal risk that is somewhat wider in scope, including e.g. consequences such as lack of trust
in the government and other impacts on society. Societal risk is considered to be a subset of societal
concern [9], [10].
On the other hand, if identified individuals or a group of individuals are exposed to additional risk, e.g.
occupational risk due to work-related hazards, criteria based on individual risk are most appropriate.
When individual risks are discussed, it will often be suitable to consider an exposed user, i.e. an
imaginary person that is especially exposed to the hazards imposed by the system. The individual risks
consist of risks of death, injuries and ill health, and the level of risk will be described by the probability of
such outcomes per some appropriate measure of exposure, e.g. year, kilometre travelled, work-hours etc.
Individual risk acceptance criteria will determine the limits between acceptable and unacceptable
probabilities of accidents causing death, injuries or ill health. For individual decisions, factors such as
voluntariness (that the risk is taken voluntary), direct benefit and degree of control influence what level of
risk are regarded as acceptable, and it may therefore be distinguished between what are acceptable risks
for say workers [11] and third parties. The factors affecting risk acceptance by individuals depend on
personal characteristics of individuals and on characteristics of risks and may also be viewed as a risk
perception issue [12].
For complex systems, risks will often be introduced to the general public as well as to a special group of
individuals and both criteria for societal risk and individual risk will have to be complied with. For
example for a passenger ship with a large number of people on board the risk of major accidents can be
described in terms of societal risk, whereas some members of the crew might be exposed to additional
hazards best described in terms of individual risk. In order to determine whether a proposed ship design
has an acceptable level of safety, all hazards must be identified, and both criteria for acceptable societal
and individual risk should be met. In addition, levels of environmental, property and economic risks
should be within the acceptable.

D.4.5.2
2 Principles for establishing risk acceptance criteria for safety

Different principles can be utilized for establishing appropriate values when developing risk acceptance
criteria for use in decision-making relating to regulation. The principles adopted will naturally influence
the criteria arrived at. In complement to the various principles for establishing values for the cost and risk
levels, other principles such as the accountability principle and the holistic principle might be used for
developing risk criteria.
2.1 Absolute probabilistic risk criteria

This principle for establishing risk acceptance criteria does not consider the cost associated with
achieving the corresponding risk level. Only the level of risk itself is studied and the risk criteria will be
formulated as a maximum level of risk that are not to be exceeded, without due regard to the cost and
benefit associated with it. An example of a criterion according to this principle could be “the frequency of
death (e.g. due to a specific hazard) shall not exceed 10-6 per person-year”. The utopian vision of zero
tolerance towards risk is another example of an absolute probabilistic risk criterion. For example, the
annual fatality rate for all reasons in the period of life when this is at its lowest (4-15 of age) was about
10-3 in OECD member countries some years ago. This is used by many regulators as an intolerable limit.
An alternative way of formulating absolute risk criteria might be to formulate criteria based solely upon
considerations of the cost, without due regard to the actual risk. Examples of such criteria could be to set
a maximum monetary value that is to be used for overall risk reduction measures in society, i.e. to state
that expenditure exceeding this value is not justifiable regardless of the level of risk. Such criteria might
not be explicitly formulated, but will be implicitly imposed upon a given society by the economy of that
society. I.e. the resources spent on risk management in western industrialized societies exceeds, by many
orders of magnitude, the resources spent in developing countries even though the risks to life and health
are by far greater in developing countries. This is partly due to an implicit but absolute risk criterion
related to the overall economics of the society, setting absolute constraints on the cost related to
controlling the risks.
2.2 The ALARP principle

Another widely used principle for determining criteria for acceptable risks is the ALARP principle. The
ALARP principle dictates that risks should be managed to be ‘As Low As Reasonably Practicable’. Both
risk levels and the cost associated with mitigating the risk are considered, and all risk reduction measures
should be implemented as long as the cost of implementing them is within the reasonably practicable
area/region according to cost effectiveness considerations. Before this principle can be used in
establishing risk acceptance criteria there is thus a need for some standard measures of practicality to
which the risk levels can be compared. Again, there are several principles for defining such standards of
practicality for comparison.
Two alternative criteria often used in maritime safety regulation to determine limits of what is reasonable
practicable in combination with the ALARP principle are the Gross Cost of Averting a Fatality (GCAF)
and the Net Cost of Averting a Fatality (NCAF). These concepts are introduced in the IMO FSA
Guidelines [13]. These are cost effectiveness measures used to evaluate risk control options in terms of
ratio of additional cost to the reduction in risk to personnel in terms of fatalities averted. The NCAF
criterion also account for the possible economic benefit of the risk control option. For both the GCAF and
the NCAF criterion, appropriate quantitative values for the optimum/maximum cost of averting a fatality
must be decided upon before risk control options can be evaluated.
The definitions of GCAF and NCAF are simply:

D.4.5.2
GCAF = ∆Cost/∆PLL
NCAF = (∆Cost-∆Economic_Benefits)/∆PLL
The parameters used are:
∆Cost is the marginal cost of the Risk Control Option (RCO)

∆PLL is the reduced number of fatalities
∆Economic_Benefits is the economic benefits from implementing the RCO
Based on the GCAF or NCAF criteria discussed above, other criteria can be developed that also accounts
for reductions in quality of life due to injuries and poor health. A criterion based on the cost of gaining a
Quality Adjusted Life Year (QALE) might be an example of such a criterion, where also the state of
health is taken into account [14].
2.3 The principle of equivalency

A principle commonly used for establishing risk acceptance criteria for an activity or a system is to
compare with known levels of risks for similar activities or systems that are widely regarded as
acceptable and to require that an equal level of risk is obtained. A variety of known risk levels can be
used as a basis for comparison. Regarding the maritime transportation sector, one can for example
compare the risk to that of other means of transport, e.g. compare the risk to that of the railroad system,
the road network or the aviation system, and require equivalent levels of safety for the maritime
transportation system. Alternative, one can compare with historical risk data, and if the risk level has
generally been considered to be acceptable one can require that future levels of risk shall be equivalent or
lower than that of the past. Another possible criterion can be to require that proposed design shall be
equivalent regarding safety to past and present best practice. In order to develop explicit criteria, one must
thus determine what safety level current best practice corresponds to.
2.4 Comparison with known hazards

Another approach in line with the equivalency principle is to compare with known risk levels implicit in
normal human activities. E.g. a human life is expected to be of the order of a hundred years or 102.
Statistically, this implies an inherent background risk to human life of about 10-2 per year for all people.
With this as a starting point, and realizing that this is the sum of all risks to life, one can develop
acceptance criteria for specific areas based on the exposure and the contribution to the total risk one
allows this area to constitute. As previously mentioned, the annual fatality rate for all reasons in the
period of life when this is at its lowest (4-15 of age) was about 10-3 in OECD member countries some
years ago. This is used by many regulators as an intolerable limit for occupational risk, indicating that
occupational risk should not contribute large portions of the total risk to individuals.
2.5 The principle of maximum net benefit to all and the Life Quality Index
Another principle is to manage risk to maximize the total expected net benefit for society as a whole.
Accordingly, this should be a sufficient and rational principle for risk reduction efforts on behalf on the
public. Both the risk reduction and the cost of proposed risk reduction measures are considered, and it is
argued that if too much effort and resources are being spent on reducing risk with the goal of improving
health and safety that the net benefit are not maximized, this expenditure is not justifiable.

D.4.5.2
In order to apply the principle of maximum net benefit to all in risk management, there is the need for an
objective measure of this benefit. A measure that is widely accepted as appropriate for this is to use the
expected length of life in good health for all members of the society. The principle of maximum net
benefit to all thus indicates that risk should be reduced in order to maximize the expected length of life in
good health. Other measures may consider both mortality and wealth as well.
Although this principle seeks to maximize the net benefit to all, another principle states that no
individuals are to be sacrificed for the sake of others. I.e. it is not deemed acceptable to expose certain
individuals to additional risk in order to reduce the risk to others. This principle may be difficult to apply.
For example rescue worker may be exposed to higher risk than the normal risk level of people they are
expected to rescue. The principle of maximum net benefit to all is thus not ideally suited for managing
risks that are not equally distributed among the population. According to e.g. the Kaldor-Hicks
compensation principle, unevenly distributed risk should imply compensation to the ones most exposed,
in order to transform the losers to non-losers (e.g. [4]).
The Life Quality Index (LQI) has recently gained much attention as a summary index for the net benefit
(e.g. [5], [15], [16], [17], [18], [7]). It is a social indicator that is derived to reflect the length of quality
life in a society and it is constructed from two aggregated indicators, i.e. the life expectancy at birth and
the gross domestic product per capita. These aggregated indicators are easy to calculate for each and
every country from statistical data. The Life Quality Index as a measure of the net benefit to all can thus
be used for judging risk and risk reduction efforts for a country, and according to the Life Quality Index
criterion, safety interventions are regarded as justifiable as long as they contribute positively to LQI. The
expression for the Life Quality Index is: L = gwe(1-w) where g is the gross domestic product per capita, e is
the expected length of life at birth and w is the ratio of time spent in economic activity (e.g. in increasing
g).
The Life Quality Index criterion operates with binary health states, i.e. 0 = dead and 1 = alive. Effects of
reduced health conditions are only modelled implicitly. In order to explicitly model this and thus account
for mortality, wealth and morbidity, an alternative index based on the gross domestic product per capita
and the health adjusted life expectancy at birth has been proposed. This Health Adjusted Life Quality
Index (HALQI) can then be used as a criterion for assessing health and safety interventions in much the
same way as the LQI criterion [19]. Another proposed measure is the lifetime utility [20].
An alternative approach that is in line with the principle of maximum benefit to all is to base risk
acceptance for a given activity on the economic importance to society (i.e. all) of the activity. The
acceptance criteria will then take the form of average fatalities per unit of economic production
[21][22][23]. This approach thus justifies a higher level of risk for activities that are of major importance
to society compared to those activities with lesser economic importance. Optimization techniques have
also been introduced for setting safety targets ([24], [25], [26], [27]).
2.6 Voluntary risk reduction measures

Another approach to risk management is to remove all mandatory risk reduction requirements and let
everything regulate itself according to the governing economics of the society. This principle is based on
the assumption that resources are most efficiently spent on safety when distributed among the people,
organisations and companies in the society rather than spent on implementing mandatory safety
interventions and that the market forces efficiently internalize the risk [28]. This assumption is supported
by the observation that the safety level is generally much higher in rich, industrialised countries where
resources are available to the public for voluntarily expenditure on safety than in developing countries.
It is assumed that a high level of safety and reliability is desired from mere economic considerations, and
that companies and organisations would be willing to spend sufficient resources on voluntary safety
D.4.5.2
enhancing measures based on purely economic motivation. I.e. that an investment in safety will be cost
effective in itself up to a certain point, and that this point constitute a natural criteria for the amount of
resources it is justifiable to spend on safety. Regulatory interventions aiming at correcting market failures
that lead to an inefficient balance between risk reduction and the cost rather than solely focusing on
eliminating the risk itself would be completely in line with this principle. Furthermore, it has been
suggested that some regulations can lead to behavioural responses that unintentionally increase the risk
[29].
It can off course easily be argued that this principle will not provide a satisfactory level of safety to the
general public. It might seem a reasonable approach for activities where it is the same stakeholder that is
responsible for the activity imposing the risk and thus responsible to control the risk, that is exposed to
the risk. I.e. the ones that bear the cost of reducing the risk is also the ones that benefit form the risk
reduction. However, in most cases this is not the case and for risks that are imposed on third parties, it is
unrealistic to assume that acceptable levels of risk will be achieved if this principle is employed for
managing the risk. It is thus commonly agreed that some sort of mandatory safety regulations are needed
to control the risk to the public. However, there might be a limit for how much resources the society
should spend on mandatory safety requirements, above which the resources would be more wisely spent
on safety if left in free circulation (and not collected by e.g. taxation).
This issue is addressed in [15] where a method for establishing an upper cost limit for where no
regulations should be implemented is established, i.e. regulations with higher cost per averted fatality than
this limit would render better use of the resources for voluntary safety interventions if they are not
implemented. These limits are shown for OECD member countries in Figure 1 and compared to the limits
for where regulations would be defendable by purely economic considerations.

D.4.5.2
18
16
14
$US million
12
10
0
Fr d
F i rk
ly
Sp l
ze Ca m
te d o m
nd
Po n d
e es
D bli c
Sw in
D
Ic y
n
G y
M g
er e
Z e ds
R da
y
H ce
m a
Au a
i tz e n
r ia
N nd
ga
ay
nd
an
an
an
r
c
ic
pa
ke
ur
Ita
x e re
EC
li
a
iu
ga
la
t
an
la
e w an
ra
ch na
e
st
a
m
ex
r tu
w
Sw ed
er Sta
la
bo
lg
nl
el
Lu Ko
ur
Ja
m
re
U i ng
Ir e
Po
al
un
st
or
ep
en
O
er
N er l
Be
T
Au
d
K
h
G
ag
et
d
ni
te
N
ni
Av
C
U
Figure 1: The limits where a) regulations would be defendable by purely economic considerations (left)
and b) no regulation should be implemented as individuals would use the resources better on life saving
(right) for OECD member countries (from [15]).
2.7 The accountability principle

Another important principle for managing risk on behalf of society is the accountability principle. This
principle implies requirements for a single, open and clear process for managing the risks affecting the
public and serves as the foundation for a professional ethic for public risk management. The decision
making process should be transparent and decisions on risk should be proven to be justifiable and
communicative to the public if they are to be defendable. Once such a process is transparently settled
upon, decisions about risks to society can be made based on a sound rationale and thus transferred from
the political arena to the professional arena of risk analysts. The accountability principle also ensures that
resources are efficiently spent on reducing the actual risk and not just the public perception of risk.
The accountability principle implies transparent and clearly defined risk acceptance criteria that can be
used in decision making. Furthermore, these criteria should be quantitative rather than qualitative and
based on objective assessments rather than subjective interpretation of the risk landscape. The
formulation of criteria for acceptable risk should also be explicit rather than implicit, leaving no room for
different interpretations by different risk analysts of the acceptance criteria themselves.
2.8 The holistic principle

Decisions regarding health and safety on behalf of the public should be based on a holistic consideration
of all risks and apply across the complete range of hazards to life and health of the public. This means that
systematic efforts to evaluate all the direct and indirect consequences of all hazards are required as a basis
for risk governance. Failure to take such a holistic approach to risk governance may cause disproportional
expenditure in reducing risks in some areas in society at the expense of others. It is also possible that
measures that reduce the risk in one area will increase the risk in another. Only when the total risk the
public is exposed to is properly assessed, can proposed risk reduction measures be properly evaluated and
criteria for acceptable risk established.

D.4.5.2
High level risk acceptance criteria should therefore apply to the society as a whole and not be restricted to
specific sectors, activities or areas. Possible derivation of lower level acceptance criteria for specific areas
should then be made in accordance with the overall safety targets of the society as a whole.
2.9 Acceptance criteria based on a combination of different principles

Although some of the principles discussed above seem to be in contrast to each other, they are often used
to compliment of each other in risk management and for setting safety targets. In maritime safety
regulations for example, the combination of absolute probabilistic risk criteria is used together with the
ALARP principle [30]. A normal procedure is to establish an absolute value for the maximum tolerable
risk which is not to be exceeded regardless of the costs of keeping the risk to a level below it. Another
absolute value can be established that identifies risk levels below this value as negligible, stating that no
mandatory risk reduction measures are required for risk levels that are less than this value. Risk levels in
between these two absolute values can then be required to be kept as low as reasonable practicable
according to cost effectiveness consideration and the ALARP principle. This approach is illustrated in the
FN diagram in Figure 2, where the absolute criteria for intolerable and negligible societal risks are
indicated by the dotted lines. The ALARP area lies between these boundaries. The boundaries were
established by the method proposed in [21].
Intolerable
ALARP
Negligible
Figure 2: FN curve with two absolute probabilistic values for

intolerable and negligible risks with an ALARP area in between.
Furthermore, in the ALARP area, various principles for cost effectiveness considerations can be used to
establish a criterion for the reasonable practicable. The equivalency principle can be used to determine an
optimum NCAF or this can be derived from the principle of maximum net benefit for all using the LQI
criterion. With this approach, a combination of all the principles outlined above are utilized, i.e. absolute
probabilistic risk criteria, the ALARP principle, the principle of equivalency, the maximum net benefit
principle and the voluntary risk reduction measure principle can be used within the same regulation
regime. The principles of accountability and a holistic view on risks permeate the whole decision-making
process and apply on top of these.

D.4.5.2
An alternative way of establishing risk acceptance criteria for use in decision-making is to determine the
average acceptable risk level according to some appropriate principle, and to develop limits for acceptable
and negligible risk levels according to this, e.g. some orders of magnitude above/below the average
acceptable risk level.

D.4.5.2
3 Risk acceptance criteria for safety

Regardless of the principles utilized for establishing risk acceptance criteria, explicit and quantitative
criteria are needed for making rational decisions about risk and risk management. Risk acceptance criteria
normally place the risk in one of three categories; unacceptable, tolerable and broadly acceptable, and in
the following, some existing and proposed criteria drawing the lines between these categories are
described. It should be noted that for an activity to be regarded as tolerable when it comes to safety, no
risk should be in the unacceptable region and all risks in the ALARP area should be demonstrated to be
ALARP. The individual risk (to all, including third parties), the societal risk and the environmental risk
should thus all be taken into account.
For risks that are tolerable, they should be made as low as reasonably practicable. A criterion for what is
reasonable practicable is thus needed, and this is often given in terms of the cost of averting a fatality, e.g.
NCAF or GCAF. Alternatively, this is referred to as the cost of saving a statistical life, the value of
preventing a fatality etc. In the following, some proposed values for the NCAF/GCAF for use in the
ALARP area are outlined.
3.1 Individual risk

The individual risk consists of risk to life and health of individuals exposed to the hazards of a given
activity. If the risk to life is regarded as considerably greater than the risk of injuries and ill health (due to
the higher severity of the consequence, not necessarily due to a higher probability), the latter is often
neglected and risk acceptance criteria are given in terms of probability of death per some appropriate
measure, e.g. per year.
In [31], the following boundaries between unacceptable risk, tolerable risk and broadly acceptable
(negligible) risk are suggested (based on tolerability of risk in nuclear power stations, but also applicable
in other areas, e.g. offshore installations [32] :
Table 1: HSE boundaries
Boundary between broadly acceptable and tolerable risk 10-6 per year
Maximum tolerable risk for workers (e.g. crew members) 10-3 per year
Maximum tolerable risk for public (e.g. passengers) 10-4 per year
These criteria were proposed for used at IMO in Norway (2000) [30]. Statistics of fatal injuries in Great
Britain are published in [33], and can be compared to the above boundaries. According to these statistics,
an annual fatality rate of 7.9 x 10-6 for workers in all industries in Great Britain in 2002/03 was reported.
A European (EU member states) average workplace fatality rate, excluding transport accidents, for the
year 2000 was also presented as 2.8 x 10-5. In Norway, 49 work-related fatalities were reported1, and with
a labour force of 2.375 million2, this corresponds to an annual occupational fatality rate of 2.1 x 10-5.
Compared to the boundaries above, it is clear that as a whole, these levels of individual work related risk
are within the tolerable region of risk (10-3 – 10-6 per year for workers). Statistics that also include non-
fatal injuries and work related ill health is published in [34].
1
Norwegian Labour Inspection Authority: http://www.arbeidstilsynet.no/nyheter/pressemeldinger/PM0401.html
[online - 30.06 2004]
2
Statistics Norway: http://www.ssb.no/emner/06/01/aku/tab-2004-04-28-03.html. [online - 30.06 2004]
D.4.5.2
The provisional number of reported fatal injuries to members of the public for 2002/03 was 392 for Great
Britain [33]. With a population of 59.2 million people3, this amounts to a fatal injury rate of 6.6 x 10-6 per
year. This is also within the tolerable region of individual risk to the general public according to Table 1
above (10-4 – 10-6 per year). These observations (i.e. that the overall observed risk levels are well below
the unacceptable but above the negligible) help to substantiate the appropriateness of the boundaries for
individual risk presented above. In [30] a figure was presented also for the individual risk in shipping.
The figures indicated that the individual risk was within the ALARP area for most ship types. It should,
however, be noted that only ship accidents (not personal accidents) were included in the study, and some
ship types (e.g. fishing and passenger vessels) were not included. See Figure 3 below.
Figure 3: Individual fatality risk (annual) for crew of different ship types, shown together with the
proposed Individual Risk acceptance criterion [30].
In [30], also referenced in [35], it was suggested to use stricter criteria, by one order of magnitude, for the
target individual risk for new ships, i.e.:
Table 2: Suggested criteria for target risk for new ships
Target individual risk for workers (i.e. crew members) 10-4 per year
Target individual risk for public (e.g. passengers and public ashore) 10-5 per year
At IMO the documentation provided by Norway [30] seems to have contributed to an understanding that
most ship types are within the ALARP area with respect to individual risks. Therefore cost effectiveness
criteria may be applied (NCAF/GCAF). It should be noted that not all ship types were included in [30],
and there may also be subgroups of the standard ship types with individual risks outside the ALARP area.
3
National Statistics Online: http://www.statistics.gov.uk/cci/nugget.asp?id=760 [online - 30.06 2004]

D.4.5.2
3.2 Societal risk

For some activities or technological projects of large scope or size, there might be a demand for other risk
acceptability criteria additional to the criteria for individual risk. These criteria should take the
possibilities of catastrophic accidents of major societal concern into account, and ensure that the risks
imposed on the society from the activity are controlled. Developing and justifying such criteria are not as
straightforward as for individual risk, and both the severity of the consequence and the frequency of
occurrence of incidents need to be considered. Nevertheless, one methodology for doing this has been
widely adopted, i.e. the use of criterion lines in conjunction with FN curves, although there have been
some objections to the use of such FN-criterion lines, e.g. in [36] and [37]. One alternative way of
formulating societal risk acceptance criteria is by use of risk matrices. A series of such risk matrixes are
given in the Annex E.
FN diagrams are graphs that plot the number of fatalities, N, towards the probability of accidents with N
or more fatalities, whilst risk matrixes are fN diagrams plotting e.g. number of fatalities, N, corresponding
to the frequency, f. That is: FN diagrams plots cumulative probability distributions, risk matrixes and fN
diagrams are probability distributions (not cumulative). In general, FN curves are just a means of
presenting descriptive information about the probabilities and consequences of accidents related to a
certain activity or system. However, adding anchor points or criterion lines to FN curves has become a
widely recognized method for describing risk acceptance criteria for societal risk. An anchor point in a
FN diagram is a fixed point with a corresponding pair of consequence (i.e. number of fatalities, N) and
frequency (i.e. probability of accidents with N or more fatalities per year, F) as coordinates: (N, F). Such
anchor points have been proposed as acceptance criteria, and drawing lines through such anchor points
can extend the acceptance criteria to incidents with other consequences. There are thus two parameters
that are determining FN criterion lines, e.g. an anchor point and the slope of the FN lines.
The slope of FN criterion lines has been subject to some debate although most lines are drawn with a
slope between -1 and -2 on a log-log diagram. The slope of the lines describes the weighting in preference
of avoiding large accidents, with -1 indicating that the criteria are proportional to the number of fatalities,
N, and not some higher powers of N. A slope of -2 indicates a large aversion towards accidents with a
high number of fatalities. FN criterion lines with a slope of -1 are sometimes referred to as risk neutral,
whereas lines with slope -2 are referred to as risk averse. However, realizing that a large portion of the
potential fatalities may come from contributions with small N, and that these contributions are as
intolerable as the comparable small contributions with large N, lines with slopes -1 does indeed
correspond to risk-averse criteria. On the contrary, lines with slope -2 will be in favour of the large
contributions from accident with low N, and since this constitutes a large part of the total risk, such lines
are actually not risk averse, but rather multiple fatality-averse (consequence averse), giving more weight
to fatalities in large accidents than to fatalities in smaller accidents. In [30] FN criterion lines with
gradient -1 are proposed, and are thus regarded as most appropriate. The example criterion lines in Figure
2 are shown with a gradient of -1.
Having settled on the appropriate gradient of the FN criterion lines, an anchor point is needed in order to
describe the risk acceptance criteria. In general, different sectors will require different acceptance criteria,
and one cannot assume that it will be satisfactory to apply acceptance criteria from one sector in another
one, as various factors will affect the level of risk considered tolerable. However, on a higher level, there
might be possible to achieve some unified safety requirements. A number of different anchor points for
societal risk have been suggested in the literature and in regulations, e.g. (10, 10-4), (500, 2x10-4), (100,
10-4) and (10, 10-5) as referred to in [38], and (50, 2x10-4) as proposed in [31]. In [30] societal risk
acceptance criteria for different ship types are developed based on the economic importance of the
corresponding activity. These go through the following anchor points:

D.4.5.2
Table 3: Societal risk acceptance criteria for different ship types based on economic importance
Boundary between negligible and tolerable risk (10, 2x10-5)

Tankers
Boundary between tolerable and intolerable risk (10, 2x10-3)
Boundary between negligible and tolerable risk (10, 10-5)

Bulk and ore
carriers
Boundary between tolerable and intolerable risk (10, 10-3)

Passenger ro-ro
ships
The proposal is based on a method described in [21], [22] and [23]. The method is gaining acceptance and
is being used by e.g. some of the oil majors. The method (formulas) is reproduced in Annex C.
In addition to the proposed criteria, [30] also contains historic data for most ship types. It is demonstrated
that most ship types are in the ALARP area also for societal risks, Figure 4 is an example. At IMO this
seems to been accepted as all debates based on risk assessment, FSA, has been based on cost
effectiveness criteria. It should be noted that if no method was used to calibrate FN acceptance criteria,
and criteria were copied from other industries this could result in concluding that many ship types were
associated with intolerable risk. For example all passenger ships would be judged intolerable according to
criteria in Annex B: FN based acceptance criteria.

D.4.5.2
Figure 4: FN curves for different tankers, shown together with

established risk acceptance curves [30].
3.3 Value of preventing a fatality

In the ALARP area as described above, risks should be reduced to a level as low as reasonably
practicable. There are many ways of determining what levels of risk are reasonable practicable, and this is
often associated with the cost of further risk reduction and the willingness to pay such costs. Regarding
individual and societal risk to life, measures of this can be the referred to as cost of averting a fatality
(NCAF or GCAF), cost-per-life-saved, the value of life, the value of a statistical life etc. This cost or
value can thus serve as a risk acceptance criteria in the ALARP area, and by assigning an optimum value
for these measures it can be compared to the effect of possible risk reduction measures. If the cost per life
saved for a specific risk reduction measure exceeds the assigned value, the implementation of this risk
reduction measure will not be required. The value or cost of averting a fatality has been under constant
debate, and in the following some proposed values are presented4.
In [39] a cost-per-life-saved cut-off was sought, above which safety regulations would no longer be
effective in reducing the risk to life. The explanation for such a cut-off value is that parts of the income
will normally be spent privately on risk reduction measures, and that a loss of income will result in
increased mortality risk in the population. According to their results (for USA), a US$ 15 million
decrease in income (in a population) would lead to the loss of life-years corresponding to a statistical life.
Furthermore, an increase in income of the same amount would save an additional statistical life.
Regulations that cost more than US$ 15 million per expected life saved are therefore expected to have a
counterproductive effect on the mortality rate and US$ 15 million could thus serve as an upper bound for
the cost of saving a statistical life through regulations. Such regulations are referred to as net killers [15].
4
All values are approximately converted to and presented in US$.
D.4.5.2
Gerdtham and Johannesson [40] performed a similar study for Sweden and calculated the income loss that
would induce a statistical fatality for three different distribution formula of the cost of the safety
enhancing regulations. The three different distributions were regressive financing, i.e. that all individuals
pay the same amount, proportional financing, i.e. individuals pay a fixed proportion of the income and
progressive financing, i.e. the proportion of the income increase with income. According to the study, the
income loss that would induce an expected fatality was US$ 6.8 million for the regressive, US$ 8.4
million for the proportional and US$ 9.8 million for the progressive financing scheme (1996 dollars). In
Skjong and Ronold [15] life expectancy as a function of purchasing power were studied in order to obtain
similar cut-offs for all countries, obtaining an average of approximately US$ 9 million for the OECD
countries5 (ranging from over 16 million for USA and Luxembourg to about 2 million for Turkey).
Although the basis for the statistics in [15] was global, the methods closely reproduced the data from
individual countries (US, Sweden and India).
In [30], various published values of CAF for use as acceptance criteria were reviewed, and based on these
a CAF criterion of US$ 3 million (£ 2 million) was suggested for use by IMO. It was also noted that for
risk that are barely tolerable, higher values may be justified, and a range of values between US$ 1 – 8
million may be appropriate. In HSE (2001), a benchmark Value of Preventing a Fatality (VPF) of US$
1.5 million (£ 1 million) is described as the convention within the HSE. This value is adopted for road
safety measures, and it is noted that the VPF for some other areas such as cancer might be twice this
value.
In [5], optimum acceptable values of Implied Cost of Averting a Fatality (ICAF) were calculated for
different countries based on societal indicators and the LQI. The values found (for 1994) were e.g. US$
3.5 million for Norway, US$ 3 million for USA and Germany and US$ 2.2 million for UK and Canada.
In a later study, values for different countries were estimated, averaging US$ 2.65 million over all OECD
countries [15]. In a similar way, estimates of ICAF for Denmark were given in [16] to be between US$
1.1 – 7.6 million and in [25] ICAF values for various countries were estimated for 1998. For developed
industrialised countries, the estimated values lay between US$ 1.6 and 2.6 million. In [7] estimates based
on LQI of societal willingness to pay (SWTP) for averting 1 x 10-6 annual risk of death (i.e. one fatality
per year in a population of 1 million) are given for different discount rates for life years saved in the
future. With zero discounting rate, the SWTP was US$ 3.3 million per year (C$ 4.4 million), and with a
discount rate of 4%, this was reduced to US$ 1.1 million per year (C$ 1.5 million). These values were
found to be in agreement with other Canadian estimates of value of life, e.g. one survey that estimated the
value of life as between US$ 1 – 3 million (C$ 1.2 – 3.8 million).
According to [28], some American agencies have used the following values of a statistical life (VSL):
Federal Aviation Administration (FAA) and other Department of Transportation (DOT) agencies – US$ 3
million, Occupational Safety and Health Administration (OSHA) – US$ 3.5 million and the
Environmental Protection Agency (EPA) – US$ 6 million. Within the offshore industry, BP has used
values in the range of US$ 0.9 – 9 million and Shell has adopted guidelines stating that risk reduction
measures costing less than US$ 7.5 million shall be considered according to [32]. In 1999 Krupnick et al.
[41] carried out a survey to estimate individual’s willingness to pay for mortality risk reductions. 930
Canadian persons aged between 40 and 75 participated in the study and the willingness-to-pay estimates
was found to imply a value of a statistical life in the range of approximately US$ 1 – 3 million. It is also
worth noting that the risk matrix prepared by US Coast Guard (Table 24 in A) indicates a criterion of US$
3 million (by equalling the safety impact of one or more deaths by the economic impact of ≥ US$ 3
million in the effect scheme).
A comprehensive literature survey of the value of a statistical life based on market estimates studies over
the past three decades were presented in [42]. Published estimates of the value of a statistical life based on
5
The values for USA and Sweden were found to be in general agreement to the studies referred to above.
D.4.5.2
U.S. labour market studies, U.S. housing and product market studies and non-US labour market studies
were referred to and converted into year 2000 dollars. The U.S. labour market studies generated a median
VSL of about US$ 7 million and with half of the studies yielding a value between US$ 5 – 12 million a
typical VSL in the range of US$ 4 – 9 million was extracted. The U.S. housing and product markets
studies revealed a value of a statistical life in the same order of magnitude as the labour market studies,
although they tended to be slightly lower. The non-US studies provided VSL estimates for other countries
such as e.g. UK, Canada, Australia, India and Taiwan. In spite of the quite different labour market
conditions throughout the world, resulting in somewhat deviating estimates from the U.S. studies, the
authors concluded that the general order of magnitude of the foreign estimates were in agreement to that
of the United States.
In [43], based on a review of the literature, it was noted that a broad range of VSL could be adopted to
express the uncertainty in valuation, i.e. VSL in the range of US$ 0.75 – 15 million. However, the studies
suggested that a narrower range of US$ 3 – 6 million could be used for most applications. Furthermore,
recommended interim values for VPF by the EU Directorates-General (GE) Environment in the range
US$ 0.9 – 3.3 million were referred to. A model proposed for use in the regulation of the nuclear industry
was then established where the Value of the Spending for Saving a Statistical Life (VSSSL) was a
function of the risk to be reduced. According to this model, low risks correspond to low values of VSSSL,
and higher risks correspond to increasing values of VSSSL. As the risk approaches 1, the maximum
values for VSSSL, i.e. in the range of US$ 1.5 – 7.5 million could be applied.
Although many proposals exist for appropriate optimum values of NCAF/GCAF (the terms now used at
IMO) no universally accepted values are currently established. However, based on the above discussion,
and observing that shipping is international requiring a goal of uniform standards to define a level playing
field, it can be concluded that the criteria suggested for use by IMO in by [30] continues to be a valid
proposal, i.e. an NCAF/GCAF criterion of US$ 3 million, but with the possibility to extend this to a value
within the range of US$ 1.5 – 6 million according to the tolerability of the risk level under consideration
(Using the high number, if necessary to reduce a risk that is close to intolerable). This is also the criterion
used at IMO in all FSA studies. For those arguing that such criteria should be set by the responsible
organisation, the cost effectiveness corresponding to decisions made is considered next.

D.4.5.2
18
16
14
$US million
12
10
te dom
D
m
Fi rk
Sp l
nd
Po nd
e es
D bli c
Fr d
ly
M g
G y
Ze s
ep a
Ire d
Sw n
Ki ey
m a
Au a
un e
Ic y
ria
G nce
ga
ay
itz en
nd
an
an
d
pa
EC
ai
ad
ur
ec
an
x e re
r
et x ic
a
an
li
Ita
iu
ga
la
t
ew an
la
te urk
ra
st
rtu
w
er Sta
la
Sw ed
bo
lg
Lu Ko
Ja
ng
nl
el
an
re
a
Po
al
e
O
st
or
en
er
N erl
Be
er
T
C
Au
Av d
R
ag
d
ch
ni
N
ze
U
ni
U
C
Figure 5: The net cost of averting fatality criteria for OECD member countries. The blue (left) columns
would be defendable by purely economic considerations (production value of man), the red (middle)
columns represent the societal value (derived from the societal indicators), the yellow (right) columns
represent the limit where no regulation should be implemented as individuals would use the resources
better on life saving. The OECD average numbers are US$ 0.76 million, US$ 2.65 million and US$ 8.93
million [15].
3.4 Cost effectiveness in actual life saving interventions

Studies of cost effectiveness of actual life-saving interventions have previously been undertaken, and in
e.g. [30], average values of the willingness to pay in actual decisions from a study of more than 500 life-
saving interventions across different sectors of American society, presented in [44], were reproduced.
Although the range of cost-effectiveness was wide, a median value corresponding to the value of
preventing a fatality was found and estimated to be around US$ 1.5 million. Various published CAF
values used by some authorities within the US, UK, EU and Norway as acceptance criteria were also
listed, ranging US$ 1 - 4 million.
Some early IMO decisions and other decisions within the maritime industry based on Formal Safety
Assessment (FSA) are discussed in [35] and the cost effectiveness criteria for these are found to be
consistent and in the range of US$ 1.5 – 5 million. In the following, calculated cost effectiveness for some
additional decisions within the IMO based on FSA studies will be reviewed in terms of their estimated
GCAF and, if provided, NCAF. A short description of the various risk control options is provided in
Annex A: Descriptions of risk control options. For further descriptions and more details, reference is
made to the relevant IMO documents, i.e. MSC 74/5/4 [45] for RCOs 1 - 14, MSC 74/5/5 [46] for RCOs
15 - 26, MSC 75/5/2 [47] for RCOs 27 – 32, MSC 76/5/3 [48] for RCOs 33 – 36, MSC 76/5/5 [49] (and
described in MSC 76/INF.8 [50]) for RCOs 37 – 50 and MSC 78/4/2 [51]/NAV 50/11/1 [52] for RCOs
51 – 60. The discussions and conclusions regarding the risk control options concerning bulk carrier safety
are reported in MSC 76/23 [53], albeit the decision regarding double side skin construction was later
withdrawn.

D.4.5.2
Table 4: Risk control options and their cost effectiveness
RCO GCAF NCAF

Description Status
No. US$ x 106 US$ x 106
Strengthening all bulk heads for existing bulk
1 4.9 – 6.9 4.5 – 6.4 NCF6
carriers
Speeding up implementation of SOLAS XII
2 1.8 – 2.3 1.3 – 1.8 Rejected
(15 y. → 10 y.)
3a Increasing freeboard on capsize BC; 0.5 m > 27 > 24 NCF
3b Increasing freeboard on capsize BC; 1.5 m > 80 > 77 NCF

Not made
Coating of internal side skin structure; new-
4a 1.8 0.4 mandatory
buildings
due to DSS7
Not made
Coating of internal side skin structure; 10
4b 2.4 0.3 mandatory
year old ships
due to ESP8
Not made
4c 3.6 1.0 mandatory
year old ships
due to ESP
Not made
4d 7.1 4.0 mandatory
year old ships
due to ESP
Implemented
by new
SOLAS
Water ingress alarm in all cargo holds and
5a 0.4 – 1.3 0.4 – 1.3 XII/12.
forepeak; new-buildings
Develop
performance
standards
5b 0.9 – 3.2 0.9 – 3.2 As 5a
forepeak; 10 year old ships
5c 1.3 – 4.7 1.3 – 4.7 As 5a
5d 2.6 – 9.5 2.6 – 9.5 As 5a
Double side skin in all cargo holds; new- No final
6a 0.8 – 1.1 0.1 – 0.4
buildings decision made
Double side skin in all cargo holds; 10 year
6b 4.3 – 8.2 3.6 – 7.6 NCF
old ships
Double side skin in all cargo holds; 15 year
6c 6.2 – 10.0 5.5 – 9.4 NCF
old ships
6
Not considered any further, i.e. not recommended by the working group.
7
It was assumed that new-buildings would be double side skin constructions, and thus rendering this RCO
irrelevant.
8
It was assumed that the Enhanced Survey Programme (ESP) would provide sufficient control over the coating
conditions.

D.4.5.2
Double side skin in holds no. 1 and 2; 10 year

7a_1 1.7 – 2.6 1.4 – 2.3 NCF
old ships; Capesize
7a_2 3.8 – 8.4 2.6 – 7.2 NCF
old ships; Panamax
7a_3 4.6 – 8.6 3.0 – 6.9 NCF
old ships; Handymax
7b_1 1.8 – 2.4 1.6 – 2.2 NCF
old ships; Capesize
7b_2 6.5 – 12.0 4.9 – 10.0 NCF
old ships; Panamax
7b_3 5.9 – 9.2 4.3 – 7.6 NCF
old ships; Handymax
Covered by
8a_1 Forecastle; new-buildings; Capesize 2.6 – 4.8 2.2 – 4.5
LL 39
Covered by
8a_2 Forecastle; new-buildings; Panamax 0.6 – 1.1 0.2 – 0.7
LL 39
Covered by
8a_3 Forecastle; new-buildings; Handymax 0.2 – 0.3 <0
LL 39
8b_1 Forecastle; 15 year old ships; Capesize 21 – 40 20 – 39 NCF
8b_2 Forecastle; 15 year old ships; Panamax 4.9 – 9.2 4.3 – 8.5 NCF
8b_3 Forecastle; 15 year old ships; Handymax 1.4 – 2.7 0.8 – 2.1 NCF
Rejected, not
9a_1 Bulwark; new-buildings; Capesize 1.1 – 2.1 0.8 – 1.8
applicable
Rejected, not
9a_2 Bulwark; new-buildings; Panamax 0.3 – 0.5 <0
applicable
Rejected, not
9a_3 Bulwark; new-buildings; Handymax 0.1 – 0.2 <0
applicable
Rejected, not
9b_1 Bulwark; 15 year old ships; Capesize 9.5 – 18 8.8 – 17
cost-effective
Rejected, not
9b_2 Bulwark; 15 year old ships; Panamax 2.3 – 4.2 1.7 – 3.7
cost-effective
Rejected, not
9b_3 Bulwark; 15 year old ships; Handymax 0.7 – 1.3 0.1 – 0.6
cost-effective
Implemented
by new
SOLAS
Monitoring system for detecting water ingress
10a_1 0.7 – 0.9 0.2 – 0.4 XII/12.
in forepeak; new-buildings; Capesize
Develop
performance
standards
10a_2 0.5 – 0.7 <0 As 10a_1
in forepeak; new-buildings; Panamax
10a_3 0.1 – 0.13 <0 As 10a_1
in forepeak; new-buildings; Handymax
10b_1 5.4 – 7.7 4.6 – 6.9 As 10a_1
in forepeak; 15 year old ships; Capesize
D.4.5.2

10b_2 4.2 – 6.0 2.4 – 4.2 As 10a_1
in forepeak; 15 year old ships; Panamax
10b_3 0.8 – 1.1 0.2 – 0.5 As 10a_1
in forepeak; 15 year old ships; Handymax
ILLC 669 → IACS UR S2110 hatch covers on
11a 0.6 – 3.4 0.1 – 3.2 Rejected
existing capesize carriers; 10 year old ships
11b 0.9 – 5.1 0.3 – 4.9 Rejected
11c 1.8 – 10.2 1.0 – 9.9 Rejected
IACS UR S21 hatch cover → 30% increase in
12a design loads on existing ships; 10 year old 60 – 100 60 – 100 NCF
ships
12b design loads on existing ships; 15 year old 90 – 150 90 – 150 NCF
ships
12c design loads on existing ships; 20 year old 180 – 300 180 – 300 NCF
ships
Hydraulic hatch cover closure system on hold
13a 4.0 3.4 NCF
No. 1 hatch cover; New-buildings
13b 3.0 2.4 NCF
No. 1 hatch cover; 10 year old ships
13c 4.5 3.8 NCF
No. 1 hatch cover; 15 year old ships
13d 8.9 8.1 NCF
No. 1 hatch cover; 20 year old ship
30% increase in IACS UR S21 design loads
14 86 - NCF
for new ships
15 Sheltered mustering and Lifeboat area 1.1 – 1.6 - NCF
16 Remote operation from muster area 3.2 – 6.3 - NCF
Implemented
by new
SOLAS
17 Water level alarm 0.2 – 0.3 - XII/12.
Develop
performance
standards
Supported,
18 Immersion suits to all personnel 0.7 – 0.9 -
Implemented
RCO 21
19 Free-fall lifeboat < 0 – 0.8 - supported for
new ships
9
International Convention on Load Lines, 1966 [54].
10
IACS Unified Requirements S21 [55]

D.4.5.2
20 Add free float mode for free-fall lifeboat 0.8 – 1.2 - NCF
Supported for
new ships,
RCO 19
implemented
21 Free-fall lifeboat with free float mode < 0 – 0.8 -
due to lack of
standard for
free float
solution
22 Pick-up crane 18 – 37 - NCF
23 Enclosing existing lifeboats 1.4 – 2.0 - NCF

24 Redundant trained personnel 3.1 – 3.8 - NCF
Implemented
25 Two conventional lifeboats 0.9 – 1.1 - prior to the
FSA
Implemented
26 Throw overboard life rafts 3 – 3.6 - prior to the
FSA
Not made
Increase of corrosion margin; New-buildings
27_1 0.7 - mandatory
> 150 meters
due to DSS
Not made
Increase of corrosion margin; New-buildings
27_2 0.1 - mandatory
< 150 meters
due to DSS
Enhanced corrosion allowance; New-
28a_1 5.4 - NCF
buildings > 150 meters
Enhanced corrosion allowance; New-
28a_2 0.7 - NCF
buildings < 150 meters
Enhanced corrosion allowance; Existing > Application of
28b_1 150 meters; Complying with SOLAS XII for 5.4 - UR S31
new-buildings recommended
Enhanced corrosion allowance; Existing> 150 Application of
28b_2 meters; Not complying with SOLAS XII for 2.3 - UR S31
new-buildings recommended
Application of
Enhanced corrosion allowance; Existing <
28b_3 0.7 - UR S31
150 meters
recommended
Application of SOLAS XII; New-buildings <
29a_1 0.1 - NCF
150 meters
Application of SOLAS XII; New-buildings; Supported for
29a_2 2.2 -
Double side skin construction SOLAS XII/5
Application of SOLAS XII; Existing < 150
29b_1 4.3 - NCF
meters
Application of SOLAS XII; Existing; Double
29b_2 14 - NCF
side skin construction
Severely control of paint condition; New-
30a_1 6.8 - NCF
buildings > 150 meters

D.4.5.2
Severely control of paint condition; New-

30a_2 1.0 - NCF
buildings < 150 meters
Severely control of paint condition; Existing Application of
30b_1 > 150 meters; Complying with SOLAS XII 6.8 - UR S31
for new-buildings recommended
Severely control of paint condition; Existing> Application of
30b_2 150 meters; Not complying with SOLAS XII 2.9 - UR S31
for new-buildings recommended
Application of
Severely control of paint condition; Existing
30b_3 1.0 - UR S31
< 150 meters
recommended
Application of double side skin; New- No final
31a_1 15.9 -
building > 150 meters decision made
Application of double side skin; New- No final
31a_2 1.3 -
building < 150 meters decision made
Application of double side skin; Existing >
31b_1 150 meters; Complying with SOLAS XII for 53.1 - NCF
new-buildings
Application of double side skin; Existing >
31b_2 150 meters; Not complying with SOLAS XII 22.8 - NCF
for new-buildings
Application of double side skin; Existing <
31b_3 3.3 - NCF
150 meters
Application of UR S21; Existing > 150
32_1 meters; Not complying with SOLAS XII for 26.3 - Rejected
new-buildings
Application of UR S21; Existing < 150
32_2 > 10 - Rejected
meters
Application of UR S21; Existing; Double side
32_3 36.9 - Rejected
skin construction
UR S21 hatch covers by replacement; 1 year
33a 2.57 – 3.67 2.35 – 3.45 Rejected
old ships
33b 3.09 – 4.41 2.83 – 4.16 Rejected
old ships
33c 4.12 – 5.88 3.82 – 5.58 Rejected
old ships
33d 6.18 – 8.82 5.81 – 8.46 Rejected
old ships
UR S21 hatch covers by replacement; 20 year 12.36 – 11.91 –
33e Rejected
old ships 17.65 17.21
UR S21 hatch covers by reinforcement; 1
34a 0.99 – 1.27 0.77 – 1.05 Rejected
year old ships
34b 1.19 – 1.52 0.94 – 1.27 Rejected
year old ships
34c 1.59 – 2.03 1.29 – 1.73 Rejected
year old ships
34d 2.39 – 3.05 2.03 – 2.69 Rejected
year old ships
D.4.5.2

34e 4.78 – 6.11 4.34 – 5.66 Rejected
year old ships
UR S21 + 30% hatch covers by replacement;
35a 2.26 – 3.20 2.04 – 2.99 NCF
1 year old ships
35b 2.71 – 3.85 2.46 – 3.60 NCF
5 year old ships
35c 3.62 – 5.13 3.32 – 4.83 NCF
10 year old ships
35d 5.43 – 7.70 5.07 – 7.34 NCF
15 year old ships
UR S21 + 30% hatch covers by replacement; 10.86 – 10.42 –
35e NCF
20 year old ships 15.41 14.96
UR S21 + 30% hatch covers by
36a 1.21 – 1.54 0.99 – 1.32 NCF
reinforcement; 1 year old ships
UR S21+ 30% hatch covers by
36b 1.45 – 1.85 1.20 – 1.60 NCF
36c 1.94 – 2.46 1.64 – 2.16 NCF
36d 2.91 – 3.70 2.55 – 3.34 NCF
36e 5.83 – 7.40 5.38 – 6.95 NCF
Increase hatch cover strength to resist vertical
37a 3.1 2.7 NCF
forces; New-buildings
Considered in
Increase hatch cover strength to resist vertical
37b 54.4 53.8 connection
forces; Existing ships
with RCO 39b
Hatch cover design (Horizontal forces); New-
38a_1 0.8 0.3 NCF
buildings; Handy
38a_2 2.5 2.1 NCF
buildings; Panamax
38a_3 1.3 0.7 NCF
buildings; Capesize
Develops
standards for
Hatch cover design (Horizontal forces);
38b_1 2.3 1.6 hatch cover
Existing; Handy
securing
arrangements
Develops
standards for
Existing; Panamax
securing
arrangements
Develops
standards for
Existing; Capesize
securing
arrangements

D.4.5.2
Not made
Improved coating system; New-buildings;
39a_1 0.7 <0 mandatory
Handy
due to DSS
Not made
Panamax
due to DSS
Not made
Capesize
due to DSS
Not made
439b_1 Improved coating system; Existing; Handy 9.9 7.0 mandatory
due to ESP
Not made
39b_2 Improved coating system; Existing; Panamax 24.4 18.2 mandatory
due to ESP
Not made
39b_3 Improved coating system; Existing; Capesize 16.9 13.1 mandatory
due to ESP
Improved crew/stevedore training; New-
40a_1 0.6 0.1 NCF
buildings; Handy
40a_2 1.9 0.9 NCF
buildings; Panamax
40a_3 0.7 0.1 NCF
buildings; Capesize
Improved crew/stevedore training; Existing;
40b_1 0.8 0.1 NCF
Handy
40b_2 1.7 1.3 NCF
Panamax
40b_3 0.9 0.2 NCF
Capesize
Indication of openings; New-buildings;
41a_1 1.0 0.7 Rejected
Handy and Panamax
Indication of openings; New-buildings;
41a_2 0.5 <0 Rejected
Capesize
Indication of openings; Existing; Handy and
41b_1 2.5 2.0 Rejected
Panamax
41b_2 Indication of openings; Existing; Capesize 1.1 0.5 Rejected
Supported.
PSC inspector training; New-buildings;
42a_1 0.1 <0 MSC circular
Handy and Capesize
developed
Supported.
PSC inspector training; New-buildings;
42a_2 0.2 <0 MSC circular
Panamax
developed
Supported.
PSC inspector training; Existing; Handy and
42b_1 0.1 <0 MSC circular
Capesize
developed
Supported.
42b_2 PSC inspector training; Existing; Panamax 0.2 <0 MSC circular
developed

D.4.5.2
Actions taken
Enhanced survey and inspection; New- by IACS
43a_1 2.0 <0
buildings; Handy deemed
sufficient.
Actions taken
43a_2 4.1 <0
buildings; Panamax deemed
sufficient.
Actions taken
43a_3 1.8 <0
buildings; Capesize deemed
sufficient.
Actions taken
Enhanced survey and inspection; Existing; by IACS
43b_1 2.6 <0
Handy deemed
sufficient.
Actions taken
43b_2 5.2 <0
Panamax deemed
sufficient.
Actions taken
43b_3 2.3 <0
Capesize deemed
sufficient.
Work already
being done.
44a_1 Weather routeing; New-buildings; Handy 26.2 <0 No further
actions
required.
44a_2 Weather routeing; New-buildings; Panamax 53.7 <0 As 44a_1.
44a_3 Weather routeing; New-buildings; Capesize 23.3 <0 As 44a_1

44b_1 Weather routeing; Existing; Handy 32.5 <0 As 44a_1
44b_2 Weather routeing; Existing; Panamax 66.5 <0 As 44a_1
44b_3 Weather routeing; Existing; Capesize 29.0 <0 As 44a_1
No final
45a_1 Double hull; New-buildings; Handy 93.6 <0
decision
No final
45a_2 Double hull; New-buildings; Panamax 12.2 <0
decision
No final
45a_3 Double hull; New-buildings; Capesize 29.3 <0
decision
45b_1 Double hull; Existing; Handy 310.6 129.4 NCF
45b_2 Double hull; Existing; Panamax 49.0 14.9 NCF
45b_3 Double hull; Existing; Capesize 93.6 17.6 NCF

D.4.5.2
Referred to
Mandate BC code + link to standards for
46a 2.5 1.4 DSC Sub-
protective coatings; New-buildings
Committee11.
Referred to
Mandate BC code + link to standards for
46b 4.2 2.8 DSC Sub-
protective coatings; Existing
Committee.
Ban alternate hold loading of heavy cargoes;
47a 3.5 1.8 NCF
New-buildings
Requested
DE12 and DSC
Sub-
Ban alternate hold loading of heavy cargoes; Committees to
47b 4.3 2.9
Existing provide advice
prior to any
regulatory
action.
Standards
already
Improve control on steel repair; New-
48a_1 0.3 <0 available.
buildings; Handy
Reminder
MSC circular
Improve control on steel repair; New-
48a_2 0.1 <0 As 48a_1
buildings; Panamax and Capesize
Improve control on steel repair; Existing;
48b_1 0.4 <0 As 48a_1
Handy
Improve control on steel repair; Existing;
48b_2 0.1 <0 As 48a_1
Panamax and Capesize
Outside
Improve ship/shore communications; New- IMO’s remit.
49a_1 2206.8 << 0
buildings; Handy Prepare MSC
Circular
Improve ship/shore communications; New-
49a_2 13.3 <0 As 49a_1
buildings; Panamax
Improve ship/shore communications; New-
49a_3 303.9 << 0 As 49_a1
buildings; Capesize
Improve ship/shore communications;
49b_1 2723.5 << 0 As 49_a1
Existing; Handy
49b_2 16.3 <0 As 49_a1
Existing; Panamax
49b_3 375.8 << 0 As 49_a1
Existing; Capesize
50a Free-fall (float-free) lifeboat; New-buildings 0 <0 Supported
11
Sub-Committee on Dangerous Goods, Solid Cargoes and Containers.
12
Sub-Committee on Ship Design and Equipment

D.4.5.2
Rejected due
50b_1 Free-fall (float-free) lifeboat; Existing; Handy 9.0 8.1 to not cost-
effective
Rejected due
Free-fall (float-free) lifeboat; Existing;
50b_2 5.6 5.0 to not cost-
Panamax
effective
Rejected due
50b_3 Free-fall (float-free) lifeboat; Existing; 2.7 2.3 to not cost-
Capesize effective
51 Onboard Safety and Security Centre 9.2 7.2 NCF
No final
52 Automatic logging of information 2 <0
decision made
53 Two officers on the bridge 9.4 7.6 NCF13
No final
54a ECDIS 2 <0
decision made
54b ECDIS (no track control) 3 <0 NCF
No final
55 AIS (Integration with radar) 5 <0
decision made
No final
56 Track control system 1 <0
decision
No final
57a Improved bridge design (above SOLAS) 0.34 <0
decision made
No final
57b Improved bridge design (above average) 0.35 <0
decision
No final
58 Improved Navigator Training 0.35 <0
decision
No final
59 Implementation of guidelines for BRM14 0.87 <0
decision
No final
60 Navigation system reliability 7.1 4.8
decision
It is noted that decisions at IMO, and decisions made by IACS, have been fairly consistent in applying
US$ 3 million as a criteria. In cases of deviations there are usually some good explanation, e.g. that the
FSA had overlooked some hazards, previous decisions etc. In general it may be noted that the preventive
measures relating to reducing collision and grounding probabilities are very cost-effective measures if
compared to many other measures already implemented.
3.5 Non-fatal injuries and ill health

The risk acceptance criteria, i.e. intolerable limits for both individual and societal risk, as well as criteria
for use in cost effectiveness analysis as discussed above exclusively considers fatal consequences.
Normally, the consequence of a fatality is considered far more severe than a non-fatal injury. When
comparing the risk of injuries to the risk of fatalities therefore, the contribution to the total risk from the
former is often small in comparison. In some circumstances the frequency of accidents resulting in
13
Voluntarily implemented by many passenger ship owners
14
Bridge Resource Management

D.4.5.2
injuries and ill health might be high compared to the frequency of fatalities, and the risk associated with
such incidents may thus constitute a considerable share of the total risk. In such circumstances, additional
risk acceptance criteria for injuries and ill health may be required.
Having decided on appropriate values for preventing a fatality for use in the ALARP area, values for
preventing a major injury or for improving the health in general can be derived in a quite straightforward
manner. If societal indicators such as the LQI have been used for determining the value, it can be argued
that the effect of reduced health is implicitly accounted for, since the state of health of a population
unquestionably will have an effect on the expected length of life. This is the reason UNDP use life
expectancy as one of the main societal indicator. If it is desired to account for the effects of reduced
health more explicitly, this can be done by e.g. adopting an approach similar to the one described in [19]
and obtain an optimum value for the cost of obtaining a healthy life year (COHLY). The optimum
COHLY was estimated for a number of different countries, and found to be in the range of US$ 100,000 –
300,000 for the OECD countries.
MSC 72/16 [30] proposes a QALY (Quality Adjusted Life Years) criterion of USD 42,000 per QALY
gained. This value was found to be in perfect agreement with the median value of actual life saving
interventions reviewed in [44]. This value is lower than what was derived in [19], but a crude
COHLY/QALY criterion of USD 50,000, with a range between USD 25,000 – 100,000, is assumed to be
appropriate.
Alternatively, one can derive a value for the cost of preventing an injury from the cost of preventing a
fatality by rating the severity of the injury. An example of such a classification system is given in [56],
where the severity of an injury or disability is divided into six classes in the following way: Class 1 refers
to normal health and thus severity 0, classes 2 – 5 refer to increasing degree of disability with severity
between 0.01 and 0.99 and class 6 with a severity of 1 is equivalent to death. Within this scheme, the loss
of e.g. two limbs is rated as severity 0.5. With an established value for CAF of e.g. US$ 3 million one
could use US$ 1.5 million as an appropriate value for the cost of preventing an accident causing loss of
two limbs for a person. Similarly, one could assign a severity rate to all possible outcomes, e.g. major
injuries, from possible incidents and derive corresponding values for use in cost benefit analyses of risk
reduction measures.
The literature survey of Viscusi and Aldy [42] included estimates of the implicit value of a statistical
injury based on labour market studies both within and outside the U.S. The survey revealed that most
estimates lie in the range of US$ 20,000 – 70,000 per injury, and compared to the typical value of a
statistical life from the same literature survey15, this gives a ratio between the value of a statistical injury
to the value of a statistical fatality of approximately 1/150. This ratio is considerable lower than what is
indicated with the severity scheme suggested above, and one possible explanation for this can be that the
majority of the injuries considered in the study might be less serious and thus would be assign a low
severity if it were to be classified in a severity classification system.
In [30] the willingness to pay for injuries compared to fatalities for road accidents and the ratio of the
number of injuries to the number of fatalities for crew on UK registered vessels were studied (1997 and
1998 numbers) and it was concluded that the overall total cost of injuries could be approximately equal to
the value of fatalities for the maritime sector. According to the updated numbers, the willingness to pay
for slight injuries is still 0.9 % and the willingness to pay for serious injuries is 11% of the value of
preventing a statistical fatality for road accident [57].
The ratio of reported accidents to fatalities among crew on merchant vessels has declined slightly to 96
accidents for each fatality [58], but this includes both serious and slight injuries. Classifying injuries as
major or minor according to RIDDOR definitions [59], the ratio of serious to slight injuries was assumed
15
US$ 4 – 9 million
D.4.5.2
to be 1 to 3.416 hence resulting in 22 serious and 74 slight injuries to every fatality. This indicates that the
overall cost of injuries could actually be 3 times the value of fatalities (0.9% of 74 + 11% of 22 = 3.09). If
underreporting of injuries is taken into account, the actual cost of injuries compared to fatalities could be
expected to be somewhat higher, although underreporting is probably most widespread for slight injuries.
For situations where a disproportional large part of a population are injured or develop similar diseases or
health problems, e.g. crew members it may be necessary to express that this is intolerable or to establish
general limits for tolerability of the risk of injury and ill health beyond the cost effectiveness
considerations discussed above. Such criteria can be based on comparison to statistics representing a
larger population, e.g. the entire work-force within a country. Using Norway as an example, the country
had a labour force of 2.375 million in 20031. According to the statistics in [60], 23,036 work-related
injuries and 3,417 work-related diseases were reported in 2003. These numbers do not include the
maritime and offshore sectors, however, and including statistics from these sectors as well, one arrives at
a total of 24,403 work-related injuries and 3,987 cases of work-related illness registered for 2003 ([61],
[62]17).
There are reasons to suspect substantial underreporting of work-related injuries and illnesses and thus to
believe that the numbers should be significantly higher. However, assuming a uniform degree of
underreporting between the different activities, the numbers can nevertheless be used for comparison and
for determining whether or not the risk of injuries and ill health for an activity is intolerable. According to
the numbers presented above, without accounting for probable underreporting, an average probability of
work-related injuries and ill health in Norway of about 1.2 x 10-2 per man-labour year can be expected.
For activities with significantly higher probabilities of injuries and ill health the risk level could be
regarded as intolerable, although it should be discussed what deviations to be deemed as significant. If
frequencies one order of magnitude above this average is regarded as significantly higher, the intolerable
limit for risks of injuries and ill health for workers will be approximately 1 x 10-1 work-related
injury/illnesses per year. It should be emphasized however, that further study is required to substantiate
this number and that different limits might be more appropriate in other countries.
16
This assumption is achieved when the following injuries are regarded as serious: Amputation of hand/fingers/toe,
burns/scalds, chemical poisoning/burns from contact or inhalation, concussion/unconsciousness due to head injury,
crush injury, dislocations, eye injury and fracture of the scull/spine/pelvis/major bone in arm or leg. The remainder
of the injuries were considered slight injuries.
17
The actual number of reported injuries for 2003 does not appear in the annual report, but can be found at the web-
pages of Petroleum Safety Authority Norway: http://www.ptil.no

D.4.5.2
4 Environmental risk acceptance criteria

In addition to fulfilling requirements on individual and societal risk to people, activities that introduce
additional risks to the environment need to meet acceptance criteria for environmental risk as well.
Damage to the environment can be expressed at different levels such as organism level, population level,
habitat level or complete ecosystem level, and several environmental components can be damaged.
Environmental risk assessment is about making estimates of harm to plant and animal life and to the
ecosystem integrity that can later be compared to previously agreed risk acceptance criteria. However,
due to practicality, environmental risk analysis for a complete ecosystem is normally not performed, and
the risk is rather assessed for vulnerable single components within the environment, e.g. stock of specific
species or habitats. These serve as risk indicators and this is normally considered to be sufficient in order
to estimate the environmental risk.
In a report published by GESAMP in 2001 it was made clear that the major threats to the marine
environments came from activities on land [63]. In comparison, the environmental pressure on the oceans
due to shipping was believed to have decreased over the past decade. Nevertheless, the environmental risk
stemming from shipping activities should not be trivialized, and the following sections of this report will
discuss issues related to environmental risk and shipping.
Environmental impacts from shipping activities may be caused by regular (both legal and illegal) and
accidental releases. The regular releases (of e.g. CO2, NOX, sewage or garbage) are not considered here,
as the estimation of quantities of regular releases may be done without involving the use of risk
assessment, and the estimation of consequence is no different from releases from other sources. Risk
assessment for regular releases is only relevant if the system is not defined as the ship, and the analysis go
into analysing short and long term effects on the environment, habitat, biodiversity etc. For accidental
releases, however, risk assessment is as relevant as for accidents threatening safety of crew and
passenger. Figure 6 illustrates the most important emissions and discharges from tanker ships in
operation.
Figure 6: Emissions and discharges from ships in service (tankers)

D.4.5.2
4.1 Risk exposure from shipping

The environmental risk introduced by the shipping industry is mainly connected to the transportation of
environmentally harmful substances by ships, either tankers, bulk carriers or other types of cargo ships as
well as marine bunker oil, black water etc on all types of ships. Operational environmental impacts
caused by regular emission from the ship’s engines, machinery and waste incinerators, garbage disposal
and sewage discharge are regulated by the IMO and other legislative powers (see e.g. [63], and [65]) and
are not considered in this context of environmental risk. Although the appropriateness of current
regulations in this area could be debated, it is consequence analyses rather than risk analyses that are
necessary to estimate the acceptability of such releases, and these issues are out of scope of the current
report.
The focus of the present discussion will thus be limited to unwanted accidental environmental impacts. It
is essentially the release of environmentally hazardous cargo into the sea that constitutes the principal part
of this risk, and the risk is assumed to be proportional to the extent, i.e. volume and frequency, of these
kinds of cargo shipments. Another very important factor is the geographical operational area, e.g. through
which areas the shipments pass, but the present study will not study this issue in detail. For the purpose of
this general study, no differences in trade routes are considered, although it is noted that this is of
paramount importance when dealing with environmental risk.
Maritime incidents can also cause environmental hazardous material other than that transported as cargo
to be accidentally released in the ocean, e.g. black water (sewage), grey water, ballast water, and bunker
oil, but for the purpose of this general study, these are assumed to constitute a relatively small
environmental risk compared to that of accidental release of environmental hazardous cargo. For e.g.
accidental spillage of oil into the ocean, only 5% of the oil is caused by non-tanker accidents whereas
95% are due to tanker accidents (see Table 8). Although not the only factor determining the consequence
of an oil spill, the size of the spill is an important factor (this will be discussed later). Thus the major part
of the environmental risk of accidental spillage of environmental hazardous substances from shipping are
assumed to result from the transportation of different types of cargo at sea. This assumption obviously
represents a simplification of the risk picture, and it is acknowledged that different types of large ships are
operating with large quantities of bunker oil stored onboard. Accidental release of this bunker oil in e.g. a
collision or grounding incident may have considerable environmental impact, largely depending on the
location of a possible spill. At any rate, the quantities of oil into the ocean from non-tanker accidents are
small compared to the oil spilt in tanker accidents, and it is assumed that the environmental risk is
dominated by accidental release of cargo, most notably from tankers.
The main types of cargo transported by ships that constitute an environmental risk are oil, noxious liquids
in bulk and harmful substances in packaged form as well as any radioactive material. Ships carrying such
environmentally harmful cargo must comply with a number of special requirements. For each of the three
former categories of cargo, there is a separate annex in the International Convention for the Prevention of
Pollution from Ships [63] with regulations for reducing the risk of pollution. By oil is meant petroleum in
any form, whereas the noxious liquid substances are listed and categorized in the IBC code [66], and the
harmful substances are those substances that are identified as maritime pollutants in the International
Maritime Dangerous Goods Code [67]. Ships carrying radioactive material must also adhere to the
requirements contained in the INF code [68].
In the list of noxious liquids contained in the IBC code, the substances are i.a. categorized according to a
pollution category and a hazards category. Four different pollution categories are defined for the
categorization of different products; those presenting a major hazard (i.a. substances which are bio-
accumulated and liable to produce a hazard to aquatic life or human health, or which are highly toxic to
aquatic life), a hazard (i.a. substances which are bio-accumulated with a short retention of the order of
one week or less, or which are liable to produce tainting of the sea food, or which are moderately toxic to
D.4.5.2
aquatic life), a minor hazard (i.a. substances that are slightly toxic to aquatic life) and a recognizable
hazard (i.a. substances which are practically non-toxic to aquatic life, or causing deposits blanketing the
sea floor with a high biochemical oxygen demand) respectively to either the marine resources or human
health if discharged into the sea. The hazard category further differentiates between products that
constitute a safety hazard or a pollution hazard (i.e. environmental) or both. Products falling outside of
these categories are not assumed to present hazards to the environment to any great extent, and ships
carry such cargo need not adhere to the additional requirements for prevention of pollution from ships.
Although there are special requirements for ships allowed to carry dangerous goods at sea in order to
minimize the extent of accidental pollution of the environment, the risk of accidents involving such ships
that leads to accidental discharge into the sea can never be completely eliminated. Transportation of such
environmentally dangerous goods at sea thus represents an environmental hazard. As a crude
approximation, the environmental risk may be assumed to be proportional to the amount of goods
transported. Commodities within the seaborne trade can be divided into the five main bulks, i.e. crude oil,
oil products, iron ore, coal and grain, and other cargo. Assuming that iron ore, coal and grain does not
present any significant environmental risk, and further assuming that only the subgroup chemicals within
other cargo presents any substantial environmental risk, one can arrive at a crude estimate of the amount
of the seaborne trade imposing risk on the marine environment.
Wijnolst and Wergerland [69] present an overview of the worldwide shipping industry and estimates of
the tonne-mile18 for different commodity groups are provided. According to a broad classification into a
few commodity groups, seaborne trade with chemicals amounted to 326 billion tonne-mile in 1986.
Numbers from the same source yielded a seaborne trade for other commodities (i.e. other than the five
main bulk and thus including chemicals) of 4,293 billion tonne-miles. In other words, close to 8 % of the
other commodities within the seaborne trade were of the type chemicals. Although these numbers are data
representing the year 1986, the same percentage figure is assumed in the present discussion. It is
acknowledged that this assumption might not be accurate, it is e.g. noted that the fleet of chemical tankers
has been doubled since 1987, but the general picture is not believed to be very different. The
transportation of chemicals is still believed to only amount to a relatively small part of the total seaborne
trade.
According to [70] 8,340 billion tonne-miles crude oil, 2,080 billion tonne-miles oil products and 6,295
billion tonne-miles other cargo was transported at sea in 2000 out of a total trade of 22,940 billion tonne-
miles. Assuming 8% of other cargo is chemicals, the following trade of environmentally dangerous goods
were shipped by sea (Table 5), indicating that almost 50% of the goods transported at sea represent an
environmental risk. As can readily be seen from the table, the majority of the environmentally dangerous
goods within the seaborne trade are oil or oil products. Under the assumption that the risk is proportional
to the amount of cargo, transportation of oil and oil related products can be regarded as presenting the
most pronounced environmental risk within the maritime industry. In comparison, the risk imposed by
transportation of chemicals will be relatively small.
18
A tonne-mile is defined as tonne × mile; where tonne represents the tonnes of cargo and mile is the nautical miles
the cargo has been carried.

D.4.5.2
Table 5: Types of cargo in the worldwide seaborne trade (2000)

Seaborne trade
Type of cargo
Billion tonne- % of tonne- Million
miles miles tonnes
Crude oil 8340 36.4 % 1612
Cargo presenting
environmental risk Oil products 2080 9.1 % 412
Chemicals 504 2.2 % 172
Iron ore 2515 11.0 % 455
Cargo presenting no Coal 2500 10.9 % 520
significant
environmental risk Grain 1210 5.3 % 225
Other cargo excl. chemicals 5791 25.2 % 1978
Total 22940 100 % 5374
A study of oil spills and chemical spills in U.S. waters between 1980 and 2001 leads to similar
conclusions. I.e., for shipping activities, the volume of oil spills into the sea is considerably larger than
the volume of chemicals and other spills. The study of detailed statistics for U.S. waters, where also very
small spills were included, produced the diagrams presented below19 (Figure 7). According to these data,
85% (in volume) of the spills in U.S. waters from shipping were oil spills. Approximately 5% of the spills
were in each of the categories chemical spills, non-liquid chemical spills and other spills. For shipping
and land based activities together, oil spills represent about 25% of the total amount of spills into U.S.
waters. This is illustrated in Figure 7.
Spills in US waters 1980 - 2001 Spills in US waters 1980 - 2001

Shipping only
Other
15 %
Non-liquid Oil
Other
chemical Non-liquid 25 %
5%
6% chemical
Chemical 1%
5%
Oil Chemical
84 % 59 %
Figure 7: Spills in U.S. waters between 1980 – 2001, shipping only (left) and including land based
activities (right)
19
The study used data from the U.S. coast guard, made available online at:
http://www.uscg.mil/hq/g-m/nmc/response/stats/ac.htm
D.4.5.2
The environmental impact of a spill, and hence also the environmental risk, is not only dependent on the
amount spilled. It can therefore not automatically be assumed that the risk related to chemical or other
spills are insignificant compared to oil spills. However, oil spills are believed to represent the most
important environmental hazard from shipping, and for the purpose of this report, only oil spills will be
further discussed. Spillage of oil from shipping and criteria for implementation of risk reduction measures
related to oil spills will be discussed in a separate, subsequent section of this report.
4.1.1 Transportation of radioactive material by sea
The above Table 5 do not contain the transportation of radioactive material. This is partly because the
amount of radioactive material transported is negligible compared to that of such cargo as oil and oil
products and chemicals. In addition to the maritime regulations applicable to all ships in international
trade, i.e. IMO regulations such as SOLAS and various codes such as the IMDG and INF codes,
shipments of radioactive materials by sea must also comply with standards of the International Atomic
Energy Agency (IAEA). However, in spite of the small quanta of radioactive materials transported at sea
and the strict regulations governing such transport, it can still be regarded as presenting a perceptible risk
to the marine environment and accidents involving ships carrying radioactive material have the potential
to cause long lasting harm to the environment.
According to a research project on maritime transport of radioactive material on INF 3 ships [71], the
probability of an accident involving ships carrying radioactive material severe enough to cause the
radioactive material (RAM) package to fail is extremely remote. Furthermore, the individual radiation
doses that might result in the event of such an accident will expectedly be smaller than normal
background doses. In the report, i.a. the following is stated:
• Ship collisions are unlikely to damage a RAM flask

• Ship fires are not likely to start in the RAM hold and even if fire starts elsewhere, its spread to the
RAM hold is unlikely. Even if a fire spreads to the RAM hold, the lack of fuel or air will usually
prevent the fire from burning hot enough and long enough in the RAM to cause the release of
radioactive material from the RAM flask.
• Heat fluxes from small creeping fires which do not engulf the RAM hold are unlikely to exceed
the heat fluxes developed by the regulatory test fire for flask certification.
• Most radioactive material released to the interior of a RAM flask as a result of an accident will
deposit on the interior flask surface and flask-to-environment release fractions are small.
• Should an accident lead to the loss of a RAM flask into the ocean, recovery of the flask is likely if
it occurs on the continental shelf. If the flask is not recovered, the rate of release of radioactive
material from the flask into ocean waters will be so slow that the radiation doses received by
people who consume marine foods contaminated as a result of the accident will be negligible
compared to background doses.
• If a RAM transport ship is involved in a severe collision while in port or in coastal waters that
initiates a severe fire, the largest amounts of radioactive material that might be released to the
atmosphere as a result of the accident would cause individual radiation exposures well below
background.
The study thus concludes that the risks arising from the transportation of radioactive material by sea are
very small. It should also be noted that the world fleet of ships certified to carry radioactive materials
according to the INF code (class 1, 2 and 3) is very small compared to the world fleet of oil and chemical
tankers and other cargo ships carrying oil products. Specific risk acceptance criteria for such ship types
and activities are therefore not deemed necessary to investigate further in the current study. The
transportation of radioactive material could be dealt with as a separate issue, but this is regarded as out of
scope of the present report. Likewise, the very small number of nuclear powered ships and the risks
associated with these are out of scope.

D.4.5.2
4.2 Status at IMO

At IMO there has so far not been any application of FSA for environmental consequences. Therefore
there has not been any detailed discussion on environmental risk criteria. Most debates have been initiated
by accidents and have been highly political.
To the extent environmental risk has been debated in the Joint MSC MEPC working group on FSA, it
seems as if the tendency has been to favour the use of some cost effectiveness criteria for the risk control
options that are considered. For oil-spills this would imply that the criterion would be a $/tonnes of
accidental release of oil (and other pollutants) prevented. Information could be the cleanup and
compensation costs from spills in the past, or it could be based on willingness to pay studies. Both
methods were suggested in [72].
An example of willingness to pay for preventive measures may be identified by studying the cost and
benefits of OPA 90 and other risk control options that have been implemented in the past. For OPA 90
this has been done by US Coastguard [73]. The total costs has been estimated to $11bn and the reduction
of accidental release was estimated to 1.2m barrels, 9,167 $/barrel or about 57,660 $/tonnes. The
difference between the two approaches may be observed to be within a factor of 3 – and one tonne of oil
spill averted should be worth more that a tonne cleaned up.
The numbers here are just indicative, and it is possible to do much more detailed studies both relating to
the releases and the costs, for example by information provided by the International Oil Pollution
Compensation Funds . This was done in [74], whilst [75] used other sources. Costs varies according to
factors like size of spill, location, type of oil, response time etc. ([77]). These are however parameters that
are not known prior to an accident and decisions with respect to preventive measures on the ship should
be based on statistical analysis estimating risks of accidents that could be prevented. This may be done by
existing probabilistic outflow analysis tools.
It is, however, stressed again that IMO has not debated this issue in any detail. However MEPC 49
(paragraph 17.9 in [78]) tasked the correspondence group FSA as follows:
To consider the need to develop a risk index relevant to the protection of the marine
environment.
The status at IMO is reflected by a statement by the correspondence group (intersessional between MSC
77 and MSC 78) that looked into improving the FSA Guidelines ([79]):
The group noted that it is difficult to estimate environmental impact and damage caused
by a sea accident. Even money would not be a relevant figure for such estimation. The
United Kingdom proposed the use of Cost Utility Analysis (CUA) (when benefit can not
be valued) …. and also proposed to consider CUA in regard to this term of reference.
Another suggestion of indices is Pollutant Accidental Release Averted ($/ton), which,
however has no quantification for the consequence of release of pollutants.
The group noted that indices relevant to the protection of the marine environment have
not been well defined and are being under development. Therefore, the group could not
reach any concrete proposal on such indices for FSA.
The group, however, agreed that this item is a critical one, since environmental issues
are of a multifaceted nature, and that it should be included in the agenda of FSA for
more deliberate discussions at IMO.

D.4.5.2
The situation now, after MSC 80 (May 2005) is that a new intersessional correspondence group is tasked
as follows
consider the development of a risk index relevant to the protection of the marine
environment, taking into account the outcome of MEPC 53
At IMO the principle of equivalency is already established for pollution from oil-tankers in Regulation
13F(5) of Annex I in MARPOL 73/78 [63], and probabilistic tools have been in use since the late 80ties
(in and by DNV). The guidelines are briefly described in Annex D. An overview and background of the
regulations within IMO on prevention of pollution by oil can be found on the website:
http://www.imo.org/Environment/mainframe.asp?topic_id=231.
4.3 Precautionary principle

The precautionary principle is a way of dealing with uncertainty that is used also for environmental risks.
The principle was included in the Rio declaration on environment and development in 1992, and states
that the precautionary approach should be applied in order to protect the environment [80]. Basically, this
principle implies that for new developments or actions where the consequences are unknown but may be
judged by some to cause irreversible negative effects on the environment, it is better to not initiate the
development rather than to accept the uncertain high risk. Even though the precautionary principle is most
commonly associated with environmental risk, it can also be applied to other types of risk where the
consequences are uncertain but potentially severe. The principle is frequently referred to. However, it has
proven difficult to make the precautionary approach operational and making it more than a general
principle to make conservative assumptions, to err on the side of safety and environmental protection, and
a principle of burden of proof.
4.4 An alternative proposal

The following outlines a methodology for establishment and use of environmental risk acceptance criteria
contained in Annex D of the first revision of NORSOK standard Z-013 [81], developed for the
Norwegian offshore sector. This annex is removed in the second and current revision of the standard, [82]
but the approach to environmental risk acceptance criteria is nevertheless believed to still be relevant.
Adaptation of the following underlying principle is recommended when establishing environmental risk
acceptance criteria: “The duration of environmental damage shall be insignificant in relation to the
expected time between such damages”, implying that different categories of environmental damage may
be associated with an acceptable frequency of occurrence according to the duration of the damage. As
with individual and societal risk discussed above, environmental risk is divided into three intervals, i.e.
intolerable risk, the ALARP area and widely acceptable risk, and the risk acceptance criteria define the
boundaries between these intervals.
According to NORSOK [81], environmental damage is defined as a direct or indirect reduction of one or
several resources resulting from an accidental spill or release of oil or other contaminants, and four
categories for environmental damage is established. These categories are minor, moderate, significant and
serious and the categorisation of environmental damage is based on the recovery time, i.e. the time
required before the resource(s), e.g. stock of specific species or the biodiversity in general of habitats, has
recovered to the condition prior to the accidental spill, with due regard to natural variations over time.
The following definitions are proposed:
• Minor - environmental damage with recovery between 1 month and 1 year

• Moderate - environmental damage with recovery between 1 and 3 years
• Significant - environmental damage with recovery between 3 and 10 years
D.4.5.2
• Serious - environmental damage with recovery in excess of 10 years
According to the underlying principle stated above, the recovery following an environmental damage
should be insignificant compared to the period between such damages, and different values for what can
be regarded as “insignificant” will result in different accept criteria. For the purpose of illustration, 5% is
regarded as insignificant in the following, but it should be emphasized that this is merely used as an
example, and is not an established value used in regulations. With this interpretation of insignificant, a
minor environmental damage with an average recovery time of 0.5 years may not occur more frequently
than once every ten years. The frequencies can be translated to annual probabilities, and the following
table for acceptable frequency limits for each environmental damage category can be produced (Table 6),
based on a “typical” recovery time in each damage category.
Table 6: Acceptance criteria – oil spills (NORSOK)

Environmental Acceptable Acceptable annual
Typical recovery
damage category frequency limit probability limit
Minor ½ year < 1 event per 10 years 0.1
Moderate 2 years < 1 event per 40 years 2.5 x 10-2
< 1 event per 100

Significant 5 years 1 x 10-2
years
< 1 event per 400
Serious 20 years 2.5 10-3
years
It should be noted that this is the acceptable risk to the external environment as imposed from several
sources and activities. When e.g. several offshore fields, merchant shipping and onshore activities expose
the same environmental resources to risks, this should be taken into account. For example, if the same
environmental resources are exposed to risk from five different fields, each with two different
installations and with ten operations per year per installation, the risk acceptable limits presented above
could be split up in the following way: For each field, the acceptance limit will be 1/5 of the acceptable
frequency limit, i.e. 2 x 10-2/5 x 10-3/2 x 10-3/5 x 10-4 for the different damage categories. Similarly, the
acceptable limits for each installation will be ½ of the limit for each field, and the limit for each operation
will be 1/10 of the limit for each installation.
From the acceptable limits presented above, an ALARP area can be defined as e.g. the range between
10% - 100% of this limit. I.e. environmental risks above the limits are intolerable, risks between the limit
and 10% of the limits must be demonstrated to be ALARP, and for risks below 10% of the limits, risk
reduction measures may not be required. These environmental risk acceptance criteria may be illustrated
as in the Figure 8 below.

D.4.5.2
Environmental risk acceptance criteria

1,E-01
Intolerable risk
1,E-02 Intolerable limit

Annual frequency
ALARP Negligable boundary
Negligible risk
1,E-03
1,E-04
Minor Moderate Significant Serious
< 1 year 1 – 3 years 3 – 10 years > 10 years
Damage category
Figure 8: Environmental risk acceptance criteria
Alternatively, the environmental risk acceptance criteria for the different damage categories can be
expressed as being constant within each damage category, as the example criteria in [83] and illustrated in
the Figure 9 below.

D.4.5.2
Environmental risk acceptance criteria

1,E-01
Limit for intolerable environmental risk

Limit for ALARP
1,E-02
Annual frequency
1,E-03
1,E-04
Minor Moderate Significant Serious

< 1 year 1 – 3 years 3 – 10 years > 10 years
1,E-05
Damage category
Figure 9: Alternative environmental risk acceptance criteria
4.5 Cost-effectiveness criteria for oil spill prevention and mitigation

Environmental risk criteria such as the ones outlined in the previous section can be used for specific
geographical areas where it makes sense to perform consequence assessment of pollution due to
accidental discharge of oil and other substances. Such criteria can thus be developed and enforced by
national legislators for particular areas such as costal areas with fragile environment or with particular
activities such as offshore installations.
However, it will be difficult to apply these kinds of acceptance criteria on a global activity such as
international shipping. Off course, specific restrictions on traffic loads and types of cargo can be enforced
by national legislators on particular coastal areas, forcing various parts of the international shipping trade
to avoid these areas, but in general it will be more difficult to argue for global risk targets related to
environment that to e.g. safety. Whereas the consequence of a life lost can be regarded as equivalent
regardless on where in the world the loss occur, the consequence of one tonne of oil released into the sea
will be highly dependent on where the release take place. Nevertheless, in the following, some general
observations related to oil spill from the international shipping industry will be discussed and cost-
effectiveness criteria for oil spill preventive measures will be developed.
An abbreviated presentation of the proposed cost-effectiveness criteria for oil spill preventive measures
can be found in [84] and [85].
4.5.1 Oil inputs into the marine environment

Land based sources including refinery, municipal wastes and river run-off are the major contributors to
anthropogenic flow into the marine environment [86]. For example, 24% or 0.56 million tonnes global
D.4.5.2
input of oil into the marine environment were attributable to oil transportation and shipping in 1990
according to [87], see Table 7. Furthermore, about 80%, or 450,000 tonnes, of the oil entering the sea
from marine transportation were attributable to normal ship operations [87], [89], [90], see Table 8. The
two largest single sources of oil entering the sea from marine transportation activities are due to
operational tanker discharges, and discharges of fuel oil sludge and machinery space bilge.
Table 7: Estimates of annual inputs of oil to the marine environment, 1990 [87]
Source Tonnes %
Municipal/industrial 1,175,000 50%
Transportation 564,000 24%
Atmosphere 305,000 13%
Natural sources 258,500 11%
Offshore production/exploration 47,000 2%
Total 2,350,000 100%
In volume, the acute oil spills represent a minor part of the total discharge to the marine environment
from transport compared to operationally releases. Estimated from official sources in 1990 (Table 8),
tanker accidents accounted for 114,000 tonnes, or 20% of the total discharge from transportation.
However, if the total amount of illegal dumping of hydrocarbons to the world’s oceans is considered,
which due to their nature are not reported and hard to estimate, the proportion derived from large tanker
accidents drops even further on the ranking list. According to one source [88], “illegal” dumping and
routine operations of vessels are estimated to account for between 660,000 and more than 2.5 million
tonnes of hydrocarbons of marine pollution per year. In such a context, tanker accidents, while spatially
focused and highly visible, become even less significant for the global environment.

D.4.5.2
Table 8: Estimates of oil entering the marine environment annually

– shipping only (1990 estimates) [89]
Source (1989/90 estimates) Discharge (t/yr) Discharge (%)
Operational discharge of cargo oil from tankers20
- Crude oil: Long haul: 45 600 8.0
- Crude oil: Short haul: 20 300 3.6
- Product oil: Long haul: 20 800 3.7
- Product oil: Short haul 71 900 12.6
Subtotal 158 600 27.9
Dry docking 4 000 0.7
Marine terminals (e.g. bunker operations) 30 000 5.3
Bilge and fuel oil
- Machinery space bilges 64 400 11.3
- Fuel oil sludge 186 800 32.9
- Oily ballast from fuel oil tanks 1 400 0.2
Subtotal 252 600 44.4
Accidental spillage
- Tanker accidents 114 000 20.0
- Non-tanker accidents 7 000 1.2
Subtotal 121 000 21.2
Scrapping of ships 2 600 0.5
TOTAL 568 800 100
The legal operational release is expected to have decreased since 1989/90 due to new IMO regulations. A
more recent assessment of oil pollution to the sea reported in [91] suggested that the average annual
accidental spillage from tanker accidents between 1990 and 1999 were about 100,000 tonnes, while
operational discharges, including cargo washings, machinery space bilge and fuel oil sludge, amounted to
about 300,000 tonnes per year. In [91], a significant decrease in the release of cargo oil and machinery
space bilges since 1990 has been assumed whereas the estimate for sludge discharge has increased, partly
due to poorer quality of modern fuels. Comparing the two studies, one finds a decrease in the estimates
for both the operational (by 27 %) and the accidental (by 22 %) discharges, operational discharges
decreasing the most. Both these decreases can most likely be ascribed to regulatory developments, e.g. in
MARPOL 73/78 [63]. At any rate, the overall estimated ratio of the categories of discharge is not
significantly different from the 1990 estimates and the two studies are in general agreement regarding the
relative significance of accidental spills: Accidental spillage due to tanker accidents account for about 20
– 25 % of total discharge due to shipping and between 5 – 7 % of the total input of oil into the marine
environment.
In addition to improved regulations for operational release, certain areas like the North Sea,
Mediterranean and Baltic Seas are designated Special Areas status (MARPOL Annex I [63]), and no oil
discharges are allowed in these areas. However, the annual number of observed oil slicks between 1986
and 2003 attributable to discharges in the North and Baltic Seas does only show a slight decline (Figure
10 [92]). Figure 11 illustrates the location and numbers of oil slicks observed from this surveillance and
corresponds well with the major tanker routes. For most of the oil slicks observed (in 2003 approx. 85 %)
the source of the slick (i.e. the polluter) is not identified. The sources of most visible oil slicks, however,
are believed to be shipping and offshore installations [92].
20
Partial compliance with MARPOL 73/78

D.4.5.2
4500 0,60
4000
0,50
3500 F lig h t H o u rs
o b s e rve d s lic k s
R a t io
3000 0,40
2500
0,30
2000
1500 0,20
1000
0,10
500
0 0,00
1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003
Figure 10: All flight hours, all observed slicks and their ratio 1986 – 2003, observed by aerial
surveillance in the North Sea and Baltic Sea [92]

D.4.5.2
Figure 11: Observation of oil spillages by Aerial Surveillance in 2003 [92]
4.5.2 Accidental release of oil into the sea

Since 1974, the International Tanker Owners Pollution Federation (ITOPF) has maintained a database of
oil spills from tankers, combined carriers and barges. This covers all accidental spillages except those
resulting from acts of war. The database contains information on both the spill itself (amount and type of
oil spilt, cause and location) and the vessel involved. Information is now held on nearly 10,000 incidents,
the vast majority of which (85%) fall into the smallest category i.e. < 7 tonnes.
Figure 12 illustrates that the number of large spills (>700 tonnes) has decreased significantly during the
last thirty years. The average number of large spills per year during the 1990s was less than a third of that
witnessed during the 1970s. A study on trends in oil spills from tankers between 1995 and 2004 also
reports that there is a continuing trend towards decrease in the number and size of oil spills in incidents
from oil tankers [94]. This steady decline has been observed in spite of variations in seaborne oil trade: A
study on the transportation of oil in terms of tonne miles reveals that the average dropped notably in the
1980s compared to the 1970s but increased again in the 1990s. Since the mid-80s, there has been a steady
increase in oil transported by sea.
Figure 13 shows that few very large spills are responsible for a high percentage of the oil spilt. For
example, in the ten-year period 1990-1999 there were 358 spills over 7 tonnes, totalling 1,140 thousand
tonnes, but 830 thousand tonnes (73%) were spilt in just 10 incidents (just under 3%) [93]. The 10 largest
D.4.5.2
incidents have an average volume spilled of 83 thousand tonnes. This number is probably too large
because the Federation figures for amount of oil spilt in an incident include all oil lost to the environment,
including that which is burnt or remains in a sunken vessel [93]. This may be illustrated with Castillo de
Bellver incident (- 252,000 tonnes), where as only 50,000-60,000 tonnes were reported to be spilled to the
sea [97]. Information in [95] confirms that the total amount of oil in oil spills from tankers is completely
dominated by the largest spills.
Figure 12: Numbers of spills over 700 tonnes [93]
Figure 13: Quantities of oil spilt (in 1000 tonnes) [93]
Figure 14 shows that the majority of spills at sea are small. The graph to the left is based on historical
data from 1987 to 1997 from the Environment Canada TAG tanker spill database (only including spill of
at least 1,000 barrels) [98]. The Norwegian Centre for Transport Research (TØI) reports 2,000 tonnes of
oil to be the most likely spill size from an oil tanker of 100,000 Dwt (assuming 1/48 of the oil cargo is
spilled) [99], and the probability distribution according to this study is illustrated in the graph to the right
in Figure 14. Both these probability distributions show that the majority of oil spills at sea are small.

D.4.5.2
1
Accum ulated propability
0.8
0.6
0.4
0.2
0
0 20000 40000 60000 80000 100000
Volume of spill (tons)
Figure 14: Probability for volume oil spilled at sea based on data from Environment Canada (left) and
according to [99] (right).
ITOPF have reported the location of selected spills (Figure 15) [93]. Most of the spills reported are within
non-Asia regions. However, some of the major tanker routes are in Asian waters. Figure 16 illustrates that
collisions and groundings account for more than 60% of the incidences of more than 700 tonnes
according to [93], and in [94] an even higher share of oil spills are attributed to collision and grounding
accidents.
Figure 15: Location of selected spills [93]
Figure 16: Incidence of spills > 700 tonnes by cause, 1974 – 2004 [93]

D.4.5.2
To summarize this review of operational oil discharge and oil spill statistics it should be noted that
accidental oil spills from tanker incidents, although still constituting an environmental risk, only accounts
for a small part of the overall oil input to the sea from shipping. Furthermore, oil inputs to the sea from
shipping only constitute a small part of the total input of oil into the marine environment, at least when
illegal dumping are not considered (Illegal operational discharge of oil is out of scope of the current
report. Stricter enforcement of current regulations rather than new regulations would be required in order
to address this problem). Recent trends in both operational discharge and accidental spillage of oil from
tankers have been declining. The situation hence continues to be that oil spills from tanker accidents only
constitutes a relatively small part of the release of oil into the sea. Notwithstanding, oil spills still
constitutes an environmental hazard, and efforts should be made to further minimize the risk associated
with such spills.
4.5.3 The costs of oil spills
Obtaining detailed cost information for spills which cover a range of oil types and different geographical
areas is generally difficult. Understandably many aspects of claims settlements are confidential between
claimants and those providing compensation, and detailed cost data are not readily available [95]. The
type of oil, the location of the spill, the characteristics of the affected area and spill amount are generally
the most important factors determining the oil spill cost [95], [74], [99], [100]. However, the quality of
the contingency plan and of the management and control of the actual response operations are also
crucial.
Some cost data and important factors for determination of cost have been reported by ITOPF [95], Grey
[74], TØI [99] and White & Molloy [100]. Grey reports the cost of 68 oil spills from tankers based on
payments from the International Oil Pollution Compensation Funds (IOPC Funds). The 1971 and 1992
IOPC Funds provide compensation to victims of oil spills from tankers in countries which have ratified
the 1971 and 1992 Fund Conventions. Since 1978, they have dealt with more than 100 incidents, paying
compensation in 68 of these cases. Details of the individual incidents are presented in [74] and the costs
are found to vary from 667 to 180,000 1997 US $/tonne.
In [101] a study on the cost of oil spills after tanker incidents are reported, where e.g. information from a
total of 132 spills in Europe and the Far East collected from IOPC and OECD sources have been used to
estimate the total cost. According to this study, the four main types of costs involved in oil spill incidents
are clean-up costs, compensations of damages, cost for preventive measures and indemnification to the
ship owner. The study concludes on an average cost of about US$ 19,000 per tonne oil spilt. However,
the spill unit cost was found to be greatly dependent on the volume of the oil spill with unit costs ranging
from US$ 162,000 per tonne spilt for spill volumes less than 10 tonnes to nearly 10,000 US$/tonnes for
volumes larger than 5,000 tonnes.
Etkin [75] reports factors that impact cleanup costs in an effort to more accurately assess per-unit cleanup
cost. The basis for this investigation was an analysis of oil spill cost data contained in the OSIR
International Oil Spill database, containing over 8600 oil spills worldwide. The costs associated with
cleaning up an oil spill are strongly influenced by the type of product spilled, the location and timing of
the spill, sensitive areas affected, liability limits in place, local and national laws and clean up strategy.
The most important factors determining a per-unit amount cost are location and oil type, and possibly the
total spill amount. The amount of oil spilled can have a profound effect on the cleanup costs. Obviously,
the more oil spilled, the more oil there is to remove or disperse, and more expensive the clean up
operations. But clean up costs on a per tonne basis decreases significantly with increasing amounts of oil
spilled, as is demonstrated by Figure 17.

D.4.5.2
Figure 17: Correlation of per-tonne cleanup costs and spill size based on analysis of oil spill cost data in
the OSIR International Oil spill data base [75].
Large variations in regional cleanup costs are reported in [75]. A more recent study was presented in [76]
based on more than case studies of more than 300 spills in 40 nations, covering data up to the late 1990s.
Average regional per-unit costs associated with cleaning up an oil spill based on the estimates in [76], but
adjusted to 2006 dollars in accordance with the changes in the US Consumer Price Index (CPI) in this
period21, are illustrated in Figure 18. Average costs range from just over USD 1,000/tonne (Middle East)
to over USD 33,000/tonne (Asia).
21
This corresponds to an average annual inflation rate of approximately 2.7%, and is based on data available from
http://inflationdata.com
D.4.5.2
$ 24,000 $ 13,100
$ 33,300
$ 1,300
$ 3,900
$ 3,800
$ 6,900
Figure 18: Average regional cleanup cost per tonne (in 2006 US$). Estimates are based on [76].
A cost-estimation model is presented in [75] that includes the main factors impacting the clean up costs,
based on oil spill cost data in the Oil Spill Intelligence Report (OSIR) International Oil spill data base (a
38-year record of over 8,600 oil spills).22
White & Molloy [99] study the costs of clean up and third party damages in 360 tanker spills occurring
outside the USA between 1990 and 1999. They report that the most important factors are the type of oil,
coupled with the physical, biological and economic characteristics of the spill location. However, other
factors such as amount spilled and rate spillage, weather and sea conditions, time of the year and
effectiveness of clean up is also important for determining the overall costs of an incident. It is evident
that there is no relationship between spill cost and size of the tanker from which the oil originated (Figure
19). Some of the most expensive spills have been caused by relatively small tankers. The lack of
relationship between these parameters is not surprising. The tanker size indicates the potential spill
volume, but it is rare that an entire cargo is lost as a result of an accident.
22
A web based clean up cost estimation model is also available on the following link:
http://ceprofs.tamu.edu/rhann/links/Test.asp.

D.4.5.2
Erika
Nakhodka
Figure 19: Cost of non-US tanker, selected major oil spills for the period 1990 – 1999 [95].
ITOPF [95] reports important cleanup costs factors, cost of non-US tanker for the period 1990-1999 and
costs figures for recent tanker accidents. ITOPF claim that as every oil spill is different with its own
unique set of conditions, it is impossible to give, even within a limited geographic area, a reliable average
cost per tonne spilt. Certain notoriously expensive cases also skew any such analysis. For instance, the
most expensive oil spill in history is the Exxon Valdez (Alaska, 1989). Cleanup alone cost about US$ 2.5
billion and total costs are estimated at US$ 9.5 billion (including fines, penalties and claims settlements).
For the Nakhodka (Japan, 1997) compensation was settled at approximately US$ 219 million. Claims are
still being processed for the Erika (France, 1999), but are likely to considerably exceed the US$ 180
million. It is too early to speculate on the total cost of the Prestige accident but it is reported that clean-up
costs alone has reached US$ 1.2 billion [104].
TØI [99] have recently reported expected clean up cost as a function of oil spill size for tankers operating
in Norwegian waters (Figure 20). From the graph in Figure 20 one can derive an expected cleanup cost of
approximately NOK 100,000/tonne and this corresponds to about 10,000 – 15,000 US$/tonne depending
on the currency rate used. These figures thus seem to correspond to the European cost numbers reported
in [76], which is nearly US$ 10,000 according to Figure 18. A risk analysis made for the Danish waters
reported an average assumed clean up cost of DKK 50,000/tonnes23 [102] (in Danish. An English
summary is available in [103]) and this is also in agreement with the cost numbers reported in [76].
23
In the order of 10,000 USD/tonnes

D.4.5.2
Figure 20: Clean up costs for Norwegian waters, measured in Million NOK [99].
4.5.4 Cost data used for establishing acceptance criteria
4.5.4.1 Global cleanup cost

The average per-tonne cleanup costs for the various regions, based on the numbers presented in [76] but
adjusted from 1999 dollars to 2006 dollars according to the increase of the consumer price index for U.S.
as illustrated in Figure 18, are summarized in Table 9.
The actual value used for establishing acceptance criteria could be subject to debate. It would be a
political question which value to adopt in international regulations and the choice of this value might
seem somewhat arbitrary. However, it seems clear that criteria applicable to the global fleet should take
into account that the ships will be distributed over all the different regions. Therefore, in the international
regime of IMO for regulating ship safety, some sort of global average would be needed (this does not
prevent that regional values might be appropriate for assessing regional measures). The rationale behind
adopting a global average is that measures for mitigating oil spill risk that affects ships engaged in
international trade have the potential to reduce the oil spill risk in all regions of the world (both low-cost
regions and high-cost regions). The average statistical cost of all avoided oil spills due to implementation
of a measure is therefore what is needed, hence the need for a global average.
It is argued that a global average should reflect variations in oil tanker traffic densities between the
various geographical areas. For this purpose, data from the AMVER24 system may be utilized [105],
[106]. In Figure 21, aggregated AMVER data for a whole year (2000/2001), containing more than
126,000 ship observations, has been used to present worldwide oil tanker traffic densities. Based on this
data, the relative distribution of the world oil tanker traffic that falls in the various regions can be
estimated. This distribution is included in Table 9, based on the regions defined by Figure 22. It is noted
that observations outside of the selected regions, i.e. in open waters or in the Antarctica have been
disregarded in this study. The global average presented in Table 9 is hence weighted against this relative
distribution of oil tanker traffic, and this weighted average will be assumed appropriate as basis for
globally applicable criteria to be developed in the following. I.e. an average clean-up cost of USD 16,000
per tonne of oil spilt will be assumed.
24
AMVER homepage: http://www.amver.com
D.4.5.2
Table 9: Average cleanup costs per tonne oil spilled

Region Cost per tonne spilled (USD Share of global oil tanker
per tonne) traffic in region (%)
Middle East 1,300 7
South America 3,800 18
Africa 3,900 18
Oceania 6,900 2
Europe 13,100 11
North America 24,000 19
Asia 33,300 24
Weighted global average 15,900 100
Figure 21: Oil tanker traffic densities for 1 year 2000/2001 based on AMVER data

D.4.5.2
Figure 22: Definition of regions for estimation of relative oil tanker traffic distribution.
4.5.4.2 Environmental damage and socioeconomic costs

Estimating generic, global average environmental damage cost components of an oil spill might be more
difficult, even though models have been proposed that can be used for specific spills [107], [108], [109],
[110], [111]. Generic averages for the contribution from third party claims and socioeconomic costs are
likewise hard to estimate. However, it might be assumed that the costs related to environmental damage
and socioeconomic costs are somewhat proportional to the cleanup cost.
In [99], the environmental damage was assessed to be almost twice the cost associated with rescue and
clean up operations in Norwegian waters. Another study suggests that environmental damage costs are
small compared to response costs, but that third party costs tend to be the largest cost category [112]. In
[108], it is also suggested that environmental damages are small compared to cleanup costs, but that the
socioeconomic costs are comparable to the response costs for crude oil spills. Base cost input values were
proposed for the three components response, socioeconomic and environmental costs for modelling
purposes in [109]. According to these values for crude oil, the socioeconomic costs are about twice the
environmental damage costs, and socioeconomic and environmental damage costs together exceed the
response costs with about 25%.
It is acknowledged that in reality, the relationship between cleanup costs and socioeconomic and
environmental damage cost will be strongly dependent on the accident type, location etc. However, for
the purpose of general, globally applicable criteria some generic averages will be needed, and a ratio of
1.5 will be assumed for environmental and socioeconomic costs compared to clean up costs. It is stressed
that the uncertainty associated with this ratio is significant, and further statistics should be collected and
analysed in order to establish this more accurately. Notwithstanding, an average cost of USD 24,000 per
tonne of oil spilt will be attributed to the sum of environmental damages and socioeconomic costs for the
purpose of serving as a basis for decision making at IMO level.

D.4.5.2
4.5.4.3 Total oil spill costs
To sum up this discussion of the cost of oil spills, it is noted that a number of factors influence the per-
tonne cleanup cost associated with an oil spill: type of oil, the location of the spill, the size of the spill,
etc. However, for the purpose of suggesting global criteria for the implementation of measures to prevent
or mitigate the effect of oil spills, some generic values are needed. The actual value used for establishing
acceptance criteria could be made subject to debate, and it would be a political question which value to
adopt in international regulations. However, it should be clear that criteria applicable to the global fleet
should take into account that the ships will be distributed over all the different regions, carrying different
qualities of oil, and that some sort of global average would be needed. Thus, the assumed global average
per-unit cost of USD 16,000 for cleanup and USD 24,000 for other costs, including environmental
damage and socioeconomic costs is proposed, totalling an average cost of USD 40,000/tonne. This is the
value that is suggested as base for developing international regulations, although it is noted that regional
values might still be appropriate for assessing regional measures.
4.5.5 Criteria for implementation of oil spill risk reduction measures

The Danish Maritime Authority [102], [103] has presented detailed cost estimates for oil spill accidents.
The focus in the Danish study has been on land based risk control options, restricted to certain areas, but
the fundamental approach are believed to be valid also for risk reduction measures implemented on board
the ships. They suggest that risk reduction measures are to be implemented if:
Costs of averting a spill < F × Costs of an occurred spill (4.1)
F is an “Assurance parameter” that is F > 1 and it represents that spending money on preventing oil spills
is always preferable to costs related to occurred spill. The value of F depends on decision makers and how
the cost is allocated. The cost of averting a spill relates to the costs incurred from implementing risk
control options that will avert or mitigate oil spills (total costs divided by number of spills averted). The
cost of an occurred spill is the expected total cost associated with an oil spill, including clean-up costs,
property damage, environmental damage etc. In practice, both the cost of averting a spill and the cost of
an occurred spill will be represented by statistical average values.
Assuming an average spill of 400 tonnes (assumed representative for all ship types), the average clean up
cost of an oil spill is estimated to DKK 20 million (approximately US$ 3 million) in [102]. If losses of
lives, reparation costs, loss of income etc. are also taken into account, they estimates the average cost of
an oil spill accident to be DKK 50 million (approximately US$ 8 million). However, in these estimates,
the environmental cost such as damage on natural resources, loss of brand etc. are not taken into account.
These estimates represent the right side of the equation above although no number for the F factor is
suggested.
TØI [99] reports the typical clean up and rescue operations cost for accidents involving different ship
types, as well as for a “typical accident”. These estimates are given in Table 10 below, where the numbers
in the right column correspond to the estimates for the clean-up cost alone, excluding the costs of rescue
operations.

D.4.5.2
Table 10 : Typical clean-up and rescue costs per ship type

Ship type Total costs Clean-up costs
NOK million NOK million
Oil Tanker 9.00 8.50
Bulk Carrier 0.65 0.60
Passenger Vessel 1.30 1.20
Fishing Vessel 0.13 0.12
Typical accident 1.30 1.20
The assumed size of the oil spill in these estimates is not given, but in other parts of the report it is stated
that the most likely spill size in an oil tanker accident is 1/48 of the cargo. For a tanker carrying 100,000
tonnes of oil, this corresponds to an oil spill of 2,000 tonnes. These figures are significant lower than
what was reported in [102]25. Since the assumed size of the oil spill is not reported, the numbers are not
directly comparable. TØI continues to report (also for Norwegian waters) cost per ship type for loss of
ship and cargo, personnel damage/loss of lives and nature and environmental damage. These estimates are
reproduced in Table 11.
Table 11: Estimates of different cost elements for accidents involving different
ship types in Norwegian waters [99] (in NOK million)
Bulk Passenger Fishing Typical
Cost element Oil tanker
carrier vessel vessel accident
Rescue operations
9.0 0.65 1.3 0.13 1.3
and clean-up costs
Damage to ship and
25 7.2 2.5 0.36 3.6
cargo
Personal damage /
0.85 0.17 1.7 0.08 0.85
loss of lives
Environmental
17 4.8 1.2 0.24 2.4
damage
It can be seen from this table that environmental damages of about NOK 17 million are attributed to an oil
tanker accident. Assuming this to be representative for Danish waters as well, and adding this estimate to
the Danish estimate that did not include environmental damage, one arrives at a total average cost of a
tanker accident of approximately NOK 70 million. Clearly, the environmental damage costs will be
dependent on location, accident type and ship type, but if this estimate is adopted, it can be used for
establishing a risk criterion for implementation of risk reduction measures aim at preventing oil spills:
Costs for prevention of an oil spill accident < F × NOK 70 million (4.2)
If F is assumed to be close to 1, this would correspond to the following criterion: “Risk reduction
measures for oil tankers operating in Nordic waters are to be implemented if the costs are lower than
NOK 70 million per statistical averted oil spill”. Adopting a higher value for F would correspond to a
stricter criterion, e.g. F close to two would yield: “Risk reduction measures for oil tankers operating in
Nordic waters are to be implemented if the costs are lower than NOK 140 million per statistical averted
oil spill.”
No value for F was proposed in [102]. This is left for the decision makers to derive, but it should
obviously be > 1 to reflect that preventing an oil spill will inevitable be preferable to the costs associated
25
100 NOK ≈ 100 DKK. ≈ 16 US$
D.4.5.2
with an occurred spill. A reasonable value for F should also be restricted from being too high, so F should
be less than some maximum value yet to be determined, F < Fmax. Regardless of the exact value adopted
for F however, the approach presented above describes a sound and rational methodology for establishing
risk acceptance criteria that can be utilized within the framework of an oil spill risk assessment for oil
tankers. Cost effectiveness of available risk control options would be assessed using the criterion
presented in equation (1) in terms of the cost of implementing the measure and the expected number of oil
spills prevented due to the measure.
The cost of an oil spill accident has been demonstrated to constitute of several cost elements, such as
rescue and clean up costs, damage to ship and cargo, personal damage/loss of lives and environmental
damage. Thus, this could have been made explicit in the evaluation criteria for risk control options. In
general, such a criterion would be applicable to other types of accidents as well, not only oil spill
accidents.
Costs of averting an accident < F × Costs of an occurred accident

(4.3)
= F × [ RC + SD + CL + LI + PD + LL + ED + …]
In this formula, RC denotes rescue and clean up costs, SD denotes ship damage, CL denotes cargo loss,
LI denotes loss of income, PD denotes personal damage, LL denotes loss of lives and ED denotes
environmental damage for an average accident. It is also indicated that other cost elements could be
included.
It might be desirable to use a different insurance factor for different cost elements. I.e. some cost elements
can be expressed in terms of per tonne oil spilled, per life lost or per monetary units lost (e.g. due to ship
damage, downtime etc.). Thus the formula can be re-written with three insurance factors, Foil, Ffatalities and
Fproperty in the following way, ignoring the contributions from personal damage:
Costs of averting an accident < Foil×(RC + ED) + Ffatalities×LL + Fproperty×(SD + CL + LI) (4.4)
The above formula would serve as an evaluation criterion for all types of risk reduction measures. Some
measures, e.g. related to navigation, might reduce the risk related to both environmental damage and
safety, and all the terms in the equation should be considered. For evaluating e.g. risk reduction measures
aiming at saving lives but with no environmental or property risk reduction, only the loss of lives cost
element would be used. This is normally done in evaluation of risk control options in an FSA, and current
practise corresponds to Ffatalities ≈ USD 3 million/statistical life.
If such an evaluation criterion were to be used within regulations, e.g. in evaluating possible
implementation of mandatory risk reduction measures, it can be argued that costs related to property
damage and loss of cargo should not be included. I.e. Fproperty = 0. Another alternative criterion could be to
use Fproperty = 1. This would correspond to the two criteria Gross cost of averting an accident and Net cost
of averting an accident in analogy with the GCAF/NCAF criterion often used in cost effectiveness
assessment of safety measures.
The proposed criteria can also easily be transferred into criteria in terms of prevented tonnes of oil spilled
for purely oil spill prevention measures. Using the gross cost, i.e. Fproperty = 0 and assuming that the
measures are not contributing to enhance safety, only the following cost elements will have to be
accounted for: rescue operations and clean up costs and environmental damage. Several studies on
average clean up costs have been presented previously in this report, and the costs are found to depend on
the geographic location of a spill. However, an average cost of US$ 16,000 per tonne of oil spilt is
assumed to be a reasonable estimate.
D.4.5.2
Assessing the environmental cost component might be more difficult. However, in Table 11 [99], the
environmental damage was assessed to be about 1.8 times the cost associated with rescue and clean up
operations. This is believed to be quite high, and for the purpose of proposing general criteria, a ratio of
1.5 will be assumed. I.e., an average cost of US$ 24,000 per tonne of oil spilt will be assumed to account
for environmental damage. One tonne of oil spilt thus represents a total cost of approximately US$
40,000, not including loss of property for the owner. This would correspond to the following criteria for
the gross cost of averting a tonne of oil spilt, GCATS:
GCATS < F × US$ 40,000 (4.5)
Thus, according to this approach, measures to prevent accidental spillage of oil into the sea should be
implemented if they are assessed to have a cost effectiveness greater than F × 40,000 US$/tonne, where F
might take a value between 1 and some yet to be established value Fmax.
If a set of preventive measure are proposed for implementation instead of an individual measure, it should
be noted that the measures should not be assessed independently of the others. It should be recognised
that implementing one measure will reduce the potential for risk reduction and hence decrease the cost
effectiveness of subsequent measures. Thus, the cost effectiveness should be evaluated for all different
combinations of measures, and recommendations on implementation or not of the different measures
should be based on such a holistic view taking the interdependencies between the various measures into
account.
The cost of an oil spill is also dependent on a number of other factors, but criteria that consider all would
be complex and unpractical. E.g., the cost is greatly dependent on the type of oil that is spilled. In the
estimates used for determining a GCATS criterion above, an average per-tonne cost of oil spills have
been used based on data from a number of different spills. This represents average cost estimates for an
average oil spill incident and it reflects the fact that incidents involving all types of oil might be prevented
from a spill preventive measure. The release of some types of oil might be associated with significantly
different costs than this average estimate, but the average is what is believed to be most appropriate for
developing general rules applicable to a number of different ships. Most oil tankers are allowed to
transport different types of oil, so oil-type specific criteria do not seem to be appropriate in any case.
4.5.6 Cost effectiveness of existing regulations
In 1990, in response to the 1989 oil tanker accident involving T/V EXXON VALDEZ, the US congress
passed the Oil Pollution Act of 1990 which addressed problems associated with prevention, response and
compensation for oil pollution from vessels and facilities in US navigable waters. This act created a
regime in which new requirements in a series of different areas were developed, e.g. regarding vessel
construction, crew manning and licensing, contingency planning, enhanced response capabilities,
increasing penalties etc. OPA 90 had a significant influence on regulatory developments within IMO
where e.g. amendments to the MARPOL concerning double-hull tankers were adopted [63], and also on
European regulations on single hull tankers [114], [115].
In the following, the results from an assessment carried out by the US department of Transport on the
benefits, costs and cost effectiveness of some of the major rulemakings of the OPA 90 will be reviewed
[116]. A core group of 11 rules have been used as a proxy for the entire suite of rules and both the overall
benefit and cost effectiveness of this core group as well as the relative contribution of each regulation
have been assessed. In addition, optimal combinations of the 11 core rules have been determined, and it
was found that the combination of all 11 rules in the core group is the 83rd most optimal combination (out
of 2,047 possible combinations).

D.4.5.2
The measure for benefit adopted in this study is BNSR or “barrels of oil not spilled, or if spilled, removed
from the water”. In order to compare the results from this study with the criterion outlined in the previous
section, these measures could be converted using the following conversion factor and using 1 tonne of oil
≈ 7.33 barrels26: 1 TNSR = 7.33 BNSR. TNSR corresponds to “tonnes of oil not spilled, or if spilled,
removed from the water”. It should be noted that this is not equivalent to “tonnes of oil not spilled” used
in the criterion in the previous section. Furthermore, the assessment focuses on US waters while the cost
effectiveness criterion was derived based on estimates for European waters. According to Figure 18,
average clean-up costs in US waters are almost three times as high as for European waters, so direct
comparison might therefore not be appropriate. Nevertheless, for the purpose of this report, these
measures are deemed suitable for indicative comparison without further conversions.
The 11 dominant rules that were selected as the core group of regulations subject to the assessment were:
1. Double hulls
2. Deck spill control
3. Spill source control and containment
4. Lightering of single hull vessels27
5. Overfill devices
6. Operational measures for single hull vessels
7. Licenses certificates and mariners’ documents
8. Financial responsibility
9. Vessel response plans
10. Facility response plans
11. PWS equipment & personnel requirements
According to the assessment reported in [116], the overall cost effectiveness for the assessment period
(1996 – 2025) were estimated to be 8,657 US$/BNSR. Converting barrels to tonnes, this corresponds to
approximately 63,000 US$/TNSR. When comparing this cost effectiveness directly with the cost
effectiveness criteria outlined in the previous section, it might seem to suggest that an implicit value of F
≈ 1.6 were adopted for the assurance factor. Thus, the CATS criterion is found to be in general agreement
with the overall cost-effectiveness of OPA 90 for all F < 1.6. However, it should be kept in mind that
larger clean up costs are associated with oil spills in US waters compared to the global average, Table 9
indicating a factor of around 1.5. If this is taken into account, and adjusting the environmental cost
component accordingly, OPA 90 overall would be rendered cost-effective even for values of F close to 1.
At any rate, the cost effectiveness criterion is found to be in general agreement with the overall cost
effectiveness of OPA 90.
The cost effectiveness of each of the 11 core regulations were also estimated for various cases, one case
being identified as the reference case. Each rule was assessed in terms of individual cost effectiveness and
marginal cost effectiveness, i.e. considering the relative contribution that an individual rule has toward the
overall benefit. These estimates differ mainly because the costs of the rules are mainly the same for the
marginal and the individual case, whereas the rule benefit is always smaller in the marginal case. The
overlap and interaction in the overall benefit from the various rules are taken into account in order to
arrive at the marginal benefit. The marginal cost effectiveness is derived based on this marginal benefit
and compared to the individual cost effectiveness that corresponds to considering individual measures in
isolation.
26
This value (7.33 barrels per tonne) corresponds to crude oil, but will be used as a general value for all types of oil
for the purpose of this report.
27
Lightering is the process of transferring cargo at sea from one vessel to the other.

D.4.5.2
In Table 12, the cost effectiveness of the OPA 90 rules according to [116] are given. The cost
effectiveness measures are also converted from barrels to tonnes and approximate estimates in terms of
this measure are also included in the table.
Table 12: OPA 90 cost effectiveness: overall, marginal and individual

Marginal cost effectiveness Individual cost effectiveness
OPA 90 rule
(US$/BNSR) (US$/TNSR) (US$/BNSR) (US$/TNSR)
Overall cost effectiveness 8,657 63,000 N/A N/A
Double hulls 68,079 499,000 29,563 217,000
Deck spill control 31,141 228,000 8,813 65,000
Spill source control and
3,492 26,000 1,243 9,000
containment
Lightering of single hull
1,207 9,000 434 3,000
vessels
Overfill devices 29,054 213,000 8,528 63,000
Operational measures for
3,687 27,000 981 7,000
single hull vessels
Licences, certificates and
4,503 33,000 1,275 9,000
mariner’s documents
Financial responsibility 201 1,000 189 1,000
Vessel response plans 64,640 474,000 24,981 183,000
Facility response plans 3,039 22,000 1,313 10,000
PWS equipment &
108,857 798,000 40,318 296,000
personnel requirements
It can be seen from the table that the individual cost effectiveness of the different OPA 90 rules varies
greatly. Examining e.g. the double hull requirement in isolation, and comparing with the cost
effectiveness criterion, it can be seen that a value of F exceeding 5 would need to be chosen if the double
hull requirement should fall under the limit. If factor of 1.5 is assumed to account for the difference in oil
spill costs between global average and US waters, a criterion translated to US waters would be F × US$
60,000. Thus, if the double hulls requirements are to be regarded as recommendable according to this
criterion, the value of F should be more than 3.6. However, if the marginal benefit of the double hull
requirement were considered, taking the effect of the other rules into account, an F factor above 8 would
be required to render it cost effective.
Another earlier study presented in [117] assessed the cost effectiveness of eight different design
alternatives in comparison to a base case of pre-OPA 90 tanker designs. One of the design alternatives
considered was double hull, and estimates of cost effectiveness in terms of cost increase per tonne of oil
spill avoided were made for typical years as well as for major spill years:
• 134,000 – 216,000 US$/tonne for a typical year

• 25,000 – 40,000 US$/tonne for a major spill year.
Compared to the assessment presented in [116], the upper bound of these values (for a typical year) is
seen to extend up to just the estimate in [116], see Table 12. The estimates in [117] are thus somewhat
lower than the estimates in [116], but in general it can be concluded that the estimates are roughly in
agreement. It should also be noted that the assessment presented in [117] precedes the assessment in [116]
with five years, and that it therefore seems reasonable to expect somewhat lower estimates. Finally, if this
D.4.5.2
range of values is compared to the oil spill criterion discussed above, using the U.S. values for the oil spill
costs, a corresponding range of values for F would be around 2 – 4 in order to make this a cost effective
preventive measure.
Based on the two studies referred to above, it can be seen that a value of F for the criterion in equation (3)
exceeding 3 would be in line with previous decisions regarding double hull of oil tankers. However, it
should be kept in mind that such criteria are not to be regarded as definite acceptance criteria for various
risk control measures. Other factors might also influence the decision makers and the criterion should be
seen rather as an indicative measure of cost effectiveness. However, judged by the cost effectiveness
alone, and if considered irrespective of the other rules, the double hull tanker legislation corresponds to a
value of F about 3.5. However, when considering the other OPA 90 rules and taking the risk reduction
achieved from these into account, the insurance factor for the double hulls rule rises to more than 8.
The implicit insurance factors associated with each of the 11 individual OPA 90 rules are given in Table
13 below. An F factor is given for both the marginal and individual contribution to risk reduction from all
the 11 rules. It can be seen that the insurance factors implicit in the OPA 90 rules ranges from very small
to more than 13. The overall insurance factor, i.e. corresponding to implementing all the 11 rules as one
option is found to be 1.1. These insurance factors correspond to using the estimated oil spill costs for U.S.
waters, i.e. a total cost of US$ 60,000 per tonne of oil spilled. This is not identical to the criterion
suggested for international regulation previously in this report, but it is deemed more appropriate for
evaluation of the implicit F factor in the OPA 90 regulations, since OPA 90 was originally concerned
with U.S. waters (compared to the average global cost estimates, the overall implicit F factor would be
1.6). The cost effectiveness estimates from [116] have been used, but it is stressed that the assessment
itself and how these estimates were arrived at have not been evaluated. The accuracy of the F factors
listed below is thus assuming that the results are valid, and reservations should be made towards possible
flaws or unrealistic assumptions in the way the estimates in [116] are derived.
It is not the aim of this report to evaluate the OPA 90 rules, but it is noted that with the proposed
methodology of assessing oil spill prevention measures in terms of Gross/Net Cost of Averting a Tonne
oil Spilt, GCATS/NCATS, some of the core OPA 90 rules would have been rendered not cost-effective
by the assessment reported in [116]. Especially, the following three rules are far less cost effective than
the other rules:
• PWS equipment & personnel requirements

• Double hulls
• Vessel response plans

D.4.5.2
Table 13: Implicit insurance factors associated with OPA 90 rules

OPA 90 rule F marginal F individual
Overall 1.1
Double hulls 8.3 3.6
Deck spill control 3.8 1.1
Spill source control and containment 0.4 0.2
Lightering of single hull vessels 0.2 0.05
Overfill devices 3.6 1.1
Operational measures for single hull vessels 0.5 0.1
Licences, certificates and mariner’s documents 0.6 0.2
Financial responsibility 0.02 0.02
Vessel response plans 7.9 3.1
Facility response plans 0.4 0.2
PWS equipment & personnel requirements 13 4.9

D.4.5.2
5 Economic and property risk acceptance criteria

When it comes to the economic risk, i.e. the risk of loosing money, no mandatory requirements of
acceptable risk levels will normally be required. Such risks are easily translated into a monetary value,
and purely economic risk analyses will normally be thoughtfully considered before novel technological
projects are initiated. Acceptance criteria for such types of risks will thus not be further discussed.

D.4.5.2
6 Other issues
6.1 Updating acceptance criteria

Acceptance criteria will not be constant over time. All methods described in SAFEDOR D.5.1.2 are based
on information that would change with time. On the other hand acceptance criteria fulfil the criteria of
being ‘long standing and independent if technology’ mentioned in the IMO (MSC 80) definition of Goal
based standards. It should be sufficient to revise the criteria every ten to twenty years, with the exception
of the criteria based on cost effectiveness. These criteria may be updated more frequently. This would be
consistent with what other regulatory bodies do. For example many nations update the CAF criteria
annually.
The CAF criteria derived from the Social Indicators result in a formula
ge 1 − w (6.1)
NCAF = ∆g max
⋅ ∆e =
4 w
This criterion is easily updated from global statistics, e.g. from the website of OECD. The only parameter
that varies significantly from year to year is g (Gross National Product (GNP) Per Capita). Typically an
increase by 2-3% may be observed annually. It may therefore be sufficient to update the criterion by the
annual increase in GNP per capita. This is also what some national authorities do. In a more refined
analysis, the updating should also include the updating of the life expectancy at birth (e) and the
percentage of the lifetime spent in economic activity (w). Updating ‘e’ is as easy as updating ‘g’.
Updating ‘w’ is however, a time consuming job, as this statistics is not easily accessible.
The FN diagrams should also be updated, from time to time. This can be done the same way as they were
derived. The necessary statistics are easily available. The situation is the same for the CATS criteria
related to oil spills. All such updating should preferably be done at IMO level.
6.2 Depreciation of future costs – Interest rates

The depreciation of future costs and benefits (e.g. life saved) in a cost benefit analysis or a cost
effectiveness assessment is a nontrivial issue, which has resulted in considerable debates. Interest rates in
cost benefit assessment and risk assessment may influence results to a considerable degree. The reason is
that many risk control options are technical installations and design modifications that will be part of the
costs of constructing the ship, whilst the benefits may be reduced risks at the end of the design life (e.g.
25 years). Further, it should be noted that in an economic decision the interest rate reflects the economic
risk of the investment. As risks are made explicit in CBA/CEA and in an FSA the interest rate should not
include any element of risk premium or opportunities for alternative investments. The interest rate is not
the interest rate found in the corporate investment manual (the corporate rate of return).
It would also seem unethical to be able to delay an investment in safety for an economic benefit. This
would be the case if the safety budget could be placed as a risk free investment, and only part of the
resulting increased budget was allocated to safety. These ethical considerations are made in [5] to show
that the CAF criterion should increase with the risk free rate of return. A similar argument has been used
by Paté-Cornell in [131].

D.4.5.2
The conclusion of the question of interest rates to be used in cost-effectiveness studies is therefore
suggested as follows:
For a decision in any given year
• All future monetary costs should be depreciated to present value with an interest rate
corresponding to a ‘risk-free’ rate of return (e.g. future maintenance, inspection, and training).
• Investment costs should be in present value
• All monetary risks should be handled the same way as monetary costs (NCAF criterion)
• No uncertainty or risk should be treated as a risk premium (as they are included explicitly).
• Lives saved should not be depreciated. For a decision now, all lives saved now or in the future
have the same value.
For comparison with an alternative decision e.g. to delay the implementation of a risk control it should be
noted that
• The acceptance criteria should be expected to increase corresponding to the formula given in the
previous a ‘risk-free’ rate of return.
• The actual future acceptance criteria are the concern of future decision-makers.

D.4.5.2
7 Recommendations
This report describes criteria used for safety (loss of life, limb and health) and harm to the maritime
environment (currently limited to accidental releases of oil and oil products). The criteria may be briefly
summarised as follows:
Individual risk:
Risk evaluation criteria for crew and passengers on ships are described in the following table. For crew
the assumption is that the real risk exposure during a year is ½ a year. For passengers the exposure should
be representative for the most exposed passengers.
Individual Risk
Limit Who P [per ship-year]
Intolerable Crew 10-3
Intolerable Exposed passenger 10-4
Negligible Crew and passengers 10-6
Between these bounds the risk should be reduced to ALARP, implying that cost effective risk control
options should be implemented.
Parameter Criterion Range
Cost of averting a CAF (GCAF/NCAF) $1.5million [$0.75-$3.0 million]
fatality (when injuries
are accounted for
separately)
Cost of averting loss of COHLY $50,000 [$25,000-$100,000]
a life-year in good Cost per QALY
health
Cost of averting a CAF (GCAF/NCAF) $3.0 million [$1.5-$6million]
fatality (used as
indicator including also
serious and less serious
injuries)
Societal risk
Reference is made to FN-diagrams and the description, see Table 3 and Annex C. The anchor points in
the FN diagrams are as follows:

D.4.5.2
Societal risk acceptance criteria for different ship types based on economic importance
Boundary between negligible and tolerable risk (10, 2x10-5)

Tankers
Boundary between tolerable and intolerable risk (10, 2x10-3)

Bulk and ore
carriers

Passenger ro-ro
ships
A general method for deriving societal risk acceptance criteria is described in Annex C. The
model should be used for ships deviating strongly from standard ship types, and this table should
be updated from time to time.
Environmental Risk
Reference is made to the cost effectiveness of averting pollution described in Chapter 4. The decision
parameter proposed is called CATS (Cost of Averting one Tonne of oil Spilled). Other pollutants that are
considered having other damaging effect to the environment than oil (crude oil) are scaled to the
equivalents effect by deriving conversion factors.
Environmental risk
Parameter Criterion Range
Cost of Averting a CATS $60.000 /tonne [US$ 30.000-US$
Tonne of oil Spill 90.000] /Tonne

D.4.5.2
8 References
[1] Intership, 2004, “Review of Existing Risk Evaluation Criteria”, Rolf Skjong, Erik Vanem.
Intership subproject II-2 report: T03-01-2004-09-15-REP-DNV-V2, 2004.
[2] OECD (2003) “Cost Savings Stemming from Non-Compliance with International Environmental
Regulations in the Maritime Sector” OECD Maritime Transport Committee, 2003.
[3] Jonkman, S. N., van Gelder, P. H. A. J. M., Vrijling, J. K., 2003, “An overview of
quantitative risk measures for loss of life and economic damage”, Journal of hazardous materials,
A99, pp. 1-30, 2003.
[4] Nathwani, J. and Narveson, J., 1995, “3 principles for managing in the public interest”,
Risk Analysis 1995.
[5] Skjong, R. and Ronold, K. O., 1998, “Societal indicators and risk acceptance”, Proc.
OMAE 1998.
[6] Nathwani, J. S., Lind, N. C. and Pandey, M. D., 1999, “Principles for managing risk: A
search for improving the quality of decisions, Risk and Safety of Technical Systems”, 1999.
[7] Pandey, M. D. and Nathwani, J. S., 2004, “Life Quality Index for the estimation of
societal willingness-to-pay for safety”, Structural Safety 2004, vol. 26(2), pp. 181-199.
[8] Better Regulation Task Force, 2003, “Principles of Good Regulation”, 2003, ISBN: 0
7115 0438 5.
[9] HSE, 2002, “Understanding and responding to societal concersn”, HSE Research Report
034, 2002.
[10] HSE, 2002, “Taking account of societal concerns about risk – Framing the problem”,
HSE Research Report 035, 2002.
[11] Remington, J., McQuaid, J. and Trbojevic, V., 2003, “Application of risk based strategies
to workers health and safety protection – UK Experience”, Report for the Ministry of Social
Affairs and Employment, SZW, 2003, ISBN: 90-5901-275-5.
[12] Skjong, R. and Wentworth, B., H., 2001, “Expert Judgement and Risk Perception”,
Offshore and Polar Engineering conference, ISOPE, Stavanger, June 2001, Volume IV, pp 537-
544, 2001.
[13] MSC/Circ. 1023, 2002, “Guidelines for Formal Safety Assessment (FSA) for use in the IMO
rule-making process, IMO, 2002.
[14] Phillips, C. and Thompson, G., 2001, “What is a QALY?”. Available online at:
http://www.evidence-based-medicine.co.uk/ebmfiles/WhatisaQALY.pdf
[15] Skjong, R. and Ronold, K., O., 2002, “So much for safety”, Proc. OMAE 2002.
[16] Ditlevsen, O., 2003, “Decision modelling and acceptance criteria”, Structural Safety 2003, vol.
25(2), pp. 165-191, 2003.
[17] Ditlevsen, O., 2004, “Life Quality Index revisited”, Structural Safety 2004, vol. 26(4), pp. 443 –
451, 2004.

D.4.5.2
[18] Ditlevsen, O., Friis-Hansen, P., 2005, “Life Quality Time Allocation Index – an equilibrium
economy consistent version of the current Life Quality Index”, Structural Safety 2005, vol 27(3), pp. 262
– 275, 2005.
[19] Skjong, R. and Vanem, E., 2004, “Optimised use of safety interventions”, Proc. PSAM 7/ESREL
’04, 2004.
[20] Maes, M. A., Pandey, M. D. and Nathwani, J. S., 2003, “Harmonizing structural safety levels
with life-quality objectives”, Canada Journal of Civil Engineering 30(3), pp. 500 – 510, 2003.
[21] Skjong, R. and Eknes, M., 2001, “Economic activity and societal risk acceptance”, Proc. ESREL
2001.
[22] Skjong, R. and Eknes, M., 2002, “Societal risk and societal benefits”, Risk Decision and Policy,
vol. 7, pp. 57 – 67, 2002.
[23] Skjong, R., 2002, “Risk Acceptance Criteria: current proposals and IMO position”, Surface
transport technologies for sustainable development, 2002.
[24] Rackwitz, R., 2002, “Risk acceptability and optimization”, Proc. RBO’02, 2002.
[25] Rackwitz, R., 2002, “Optimization and risk acceptability based on the Life Quality Index”,
Structural Safety 2002, vol. 24(2-4), pp. 297-331, 2002.
[26] Rackwitz, R. and Streicher, H., 2002, “Optimization and target reliabilities”, Extended version of
paper presented at ASRANET-Conference, Glasgow, July 8 – 10, 2002.
[27] Faber, M., H., 2002, “Risk assessment and decision making in civil engineering”, Proc. RBO’02,
2002.
[28] Viscusi, W., K. and Gayer, T., 2002, “Safety at Any Price?”, Regulation, 20th Anniversary
Special Edition, 2002.
[29] Hahn, R., W., Lutter, R., W. and Viscusi, W., K., 2000, “Do federal regulations reduce
mortality?”, AEI Press, 2000, ISBN: 0-8447-7153-8.
[30] Norway, 2000, MSC 72/16, “Formal safety assessment – decision parameters including risk
acceptance criteria”, submitted by Norway, IMO, 2000.
[31] HSE, 2001, “Reducing Risks, protecting people”, HSE books, 2001, ISBN: 0-7176-2151-0.
[32] HSE, 2002, “Marine Risk assessment”, Offshore technology report 2001/063, 2002, ISBN: 0-
7176-2231-2.
[33] HSE, 2004, “Statistics of fatal injuries 2002/2003”, Health and safety executive, UK, 2004.
[34] HSC, 2004, “Health and Safety Statistics Highlights 2002/2003”, Health and safety commission,
UK, 2004.
[35] Safer Euroro, 2003, “Design for safety: An integrated approach to safe European roro ferry
design”, public final report, 2003.
[36] Evans, A. and Verlander, N., 1997, “What is wrong with criterion FN-lines for judging the
tolerability of risk?”, Risk Analysis, 17(2), pp. 157 – 168, 1997.
[37] HSE, 2003, “Transport fatal accidents and FN curves: 1967 – 2001”, HSE Research Report 073,
2003.
[38] Ball, D., J. and Floyd, P., J., 1998, “Societal risk”, Report from Risk Assessment Policy Unit,
HSE, 1998.
[39] Lutter, R., Morrall, J., F. and Viscusi, W., K., 1999, “The cost-per-life-saved cutoff for safety-
enhancing regulations”, Journal of economic inquiry, 37(4), pp. 599 – 608, 1999.

D.4.5.2
[40] Gerdtham, U., G. and Johannesson, M., 2002, “Do Life-Saving Regulations Save Lives?”, journal
of Risk and Uncertainty, 24(3), pp. 231 – 249, 2002.
[41] Krupnick, A., Albertini, A., Cropper, M., Simon, N., O’Brien, B., Goeree, R. and Heintzelman,
M., 2002, “Age, Health and the Willingness to Pay for Mortality Risk Reductions: A Contingent
Valuation Survey of Ontario Residents”, Journal of Risk and Uncertainty, 24(2), pp. 161 – 186, 2002.
[42] Viscusi, W., K. and Aldy, J., 2003, “The Value of a Statistical Life: A Critical Review of Market
Estimates Throughout the World”, Journal of Risk and Uncertainty, 27(1), pp. 5 – 76, 2003.
[43] Jackson, D., Stone, D., Butler, G., G. and McGlynn, G., 2004, “The derivation and application of
a risk related value of the spending for saving a statistical life”, Journal of radiological protection, 24(1),
pp. 41 – 59, 2004.
[44] Tengs, T., O., Adams, M., E., Pliskin, J., S., Safran, D., G., Siegel, J. E., Weinstein, M., C. and
Graham, J., D., 1995, “Five-Hundred Life-Saving Interventions and Their Cost-Effectiveness”, Risk
Analysis, 15(3), pp. 369 – 390, 1995.
[45] MSC 74/5/4, 2001, “Bulk Carrier Safety – Formal Safety Assessment – Fore-end watertight
integrity”, submitted by IACS, IMO, 2001.
[46] MSC 74/5/5, 2001, “Bulk Carrier Safety – Formal Safety Assessment of Life Saving Appliances
for Bulk Carriers FSA/LSA/BC”, submitted by Norway and ICFTU, IMO, 2001.
[47] MSC 75/5/2, 2002, “Bulk Carrier Safety – Report on FSA Study on Bulk Carrier Safety”,
submitted by Japan, IMO, 2002.
[48] MSC 76/5/3, 2002, “Bulk Carrier Safety – Effect of URS21 on existing hatch covers of bulk
carriers”, submitted by the United Kingdom, IMO, 2002.
[49] MSC 76/5/5, 2002, “Bulk Carrier Safety – International Collaborative FSA Study – final Report”,
submitted by the United Kingdom, IMO, 2002.
[50] MSC 76/INF.8, 2002, “Bulk Carrier Safety – International Collaborative FSA Study – FSA Step
3 (Risk Control Options)”, submitted by the United Kingdom, IMO, 2002.
[51] MSC 78/4/2, 2004, “Large Passenger Ship Safety – FSA Study on Navigational Safety of
Passenger Ships”, submitted by Norway, IMO, 2004.
[52] NAV 50/11/1, 2004, “Large Passenger Ship Safety: Effective voyage planning for large
passenger ships – FSA – Large Passenger Ships – Navigational Safety”, submitted by Norway, IMO,
2004.
[53] MSC 76/23, 2002, “Report on the Maritime Safety Committee on its seventy-sixth session”,
IMO, 2002.
[54] Load Lines, 2002, “International Convention on Load Lines, 1966 and Protocol of 1988,
consolidated edition, 2002”, IMO, 2002, ISBN: 92-801-5113-4.
[55] IACS, 2004, “Requirements concerning strength of ships”, International Association of
Classification Societies, 2004.
[56] Hyder, A., A. and Morrow, R., 2002, “Healthy life years (HeaLYs)”, in Summary Measures of
Population Health, pp. 245 – 257, WHO, Switzerland, 2002, ISBN: 92 4 154551 8.
[57] DfT, 2002, “Valuation of the Benefits of Prevention of Road Accidents and Causalities”,
Highway economics note no. 1 2002, Department of Transport, UK, 2002.
[58] MAIB, 2004, “Annual Report 2003”, Marine Accident Investigation Branch”, Department og
Transport, UK, 2004.
[59] HSE, 2000, “RIDDOR Explained”, leaflet, HSE 31 (rev 1), HSE, 2000.

D.4.5.2
[60] Arbeidstilsynet, 2004, “Årsrapport 2003”, Direktoratet for arbeidstilsynet, 2004 (in Norwegian),
ISBN: 82-90112-27-0.
[61] NMD, 2004, ”Sjøfartsdirektoratet Årsmelding 2003”, Sjøfartsdirektoratet, 2004 (in Norwegian).
[62] NPD, 2004, ”Oljedirektoratet, Norsk sokkel – årsberetning 2003”, Oljedirektoratet, 2004 (in
Norwegian).
[63] GESAMP, 2001, “A Sea of Troubles”, GESAMP (IMO/FAO/UNESCO-
IOC/WMO/WHO/IAEA/UN/UNEP Joint Group of Experts on the Scientific Aspects of Marine
Environmental Protection) and Advisory Committee on Protection of the Sea, Rep. Stud. GESAMP No.
70, 2001, ISBN 82-7701-010-9.
[64] MARPOL 73/78, 2002, ”MARPOL 73/78 consolidated edition 2002”, International Maritime
Organization, 2002, ISBN: 92-801-5125-8.
[65] Stokke, O., S. and Thommessen, Ø., B. (eds), 2003, “Yearbook of International Co-operation on
Environment and Development 2003/2004”, The Fridtjof Nansen Institute, 2003, ISBN: 1-84407-030-1.
[66] IBC Code, 1998, “International code for the construction and equipment of ships carrying
dangerous chemicals in bulk, 1998 edition”, IMO, 1998, ISBN: 92-801-1456-5.
[67] IMDG Code, 2002, “International Maritime Dangerous Goods Code”, IMO, 2002.
[68] INF Code, 2000, “International Code for the Safe Carriage of Packed Irradiated Nuclear Fuel,
Plutonium and High-Level Radioactive Wastes on board Ships”, IMO, 2000, ISBN: 92-801-5103-7.
[69] Wijnolst, N. and Wergeland, T., 1997, “Shipping”, Delft University Press, 1997, ISBN: 90-407-
1380-4.
[70] ISL, 2001, “Shipping Statistics Yearbook 2001”, Institute for Shipping Economics and Logistics,
2001, ISSN: 0721-3220.
[71] IAEA, 2001, “Severity, probability and risk of accidents during maritime transport of radioactive
material – final report of a co-ordinated research project 1995 – 1999”, IAEA-TECDOC-1231,
International Atomic Energy Agency, 2001, ISSN: 1011-4289.
[72] Mathiesen, T., C. and Skjong, R., 1996, “Towards a Rational approach to Maritime Safety and
Environmental Regulations? Market Mechanisms for safer Shipping and Cleaner Oceans”, Erasmus
University, MARE FORUM, Rotterdam, The Netherlands, 1996.
[73] Speares, S., 1991, “Enforcement cost of OPA 90 put at $11bn”, Lloyds List 18/5 2001.
[74] Grey, C., 1999, “The Cost of Oil Spills from tankers: An analysis of IOPC Fund Incidents”, Proc.
1999 International Oil Spill Conference, 1999.
[75] Etkin, D. S., 1999, “Estimated Clean up Costs for Oil Spill”, Proc. 1999 International Oil Spill
Conference, 1999.
[76] Etkin, D. S., 2000, “Worldwide Analysis of Marine Oil Spill Cleanup Cost Factors”, proc of the
23rd Arctic and Marine Oil Spill Program Technical Seminar, June 2000.
[77] White, I. C., 2003, “Factors affecting the cost of oil spill”, proc. GAOCMAO conference, 2002.
Available online at: http://www.itopf.com/costs02.PDF
[78] MEPC 49/22, 2003, “Report of the Marine Environment Protection Committee on its forty-ninth
session”, IMO, 2003.
[79] MSC 78/19, 2004, “Formal Safety Assessment – Report of the correspondence group”, Submitted
by Japan, IMO, 2004.
[80] Rio, 1992, “The Rio declaration on environment and development”, principle 15, The United
Nations Conference on Environment and Development, 1992.
D.4.5.2
[81] NORSOK, 1998, “Risk and emergency preparedness analysis”, NORSOK standard Z-013, rev. 1,
1998.
[82] NORSOK, 2001, “Risk and emergency preparedness analysis”, NORSOK standard Z-013, rev. 2,
2001.
[83] OLF, 2001, “Veiledning for gjennomføring av miljørisikoanalyser for petroleumsaktivitet på
norsk sokkel – Metode for Miljørettet Risiko Analyse (MIRA)”, Oljeindustriens Landsforening (in
Norwegian), 2001.
[84] Vanem, E., Endresen, Ø. and Skjong, R., 2007, ”CATS – Cost-effectiveness in designing for oil
spill prevention”, Proc 10th International Symposium on Practical Design of Ships and Other Floating
Structures, PRADS 2007.
[85] Vanem, E., Endresen, Ø. and Skjong, R., (2007), ”Cost-effectiveness criteria for marine oil spill
preventive measures”, in Press for Reliability Engineering and System Safety.
[86] Offshore-environment, 2002, “Oil Pollution of the Sea”, by Dr. Stanislav Patin, web site:
http://www.offshore-environment.com/oilpollution.html, 2002.
[87] Etkin, D. S., Wells, P., Nauke, M., Campbell, J., Grey, C., Koefoed, J., Meyer, T. and Reddy, S.,
1998, “Estimates of Oil Entering the Marine Environment in the Past Decade: GESAMP Working Group
32 Project”, Proc. 21st Arctic and Marine Oil Spill Program Technical Seminar, 1998.
[88] Oceana, 2003, “The dumping of hydrocarbons from ships into the seas and oceans of Europe –
The other side of oil slicks”, Oceana report, 2003. Available online at:
http://europe.oceana.org/downloads/oil-report-english.pdf
[89] Etkin, D. S., Wells, P., Nauke, M., Campbell, J., Koefoed, J., Meyer, T., Johnston, P. and Grey,
C., 1999, “Estimates of Oil Entering the Marine Environment in the Past Decade: GESAMP Working
Group 32 Project”, Proc. 1999 Oil Spill Conference, 1999.
[90] MEPC 30/INF.13, 1990, “Petroleum in the marine environment”, submitted by the United States,
IMO, 1990.
[91] Committee on Oil in the Sea: inputs, fates, and effects, Ocean Studies Board and Marine Board,
Divisions of Earth and Life Studies and Transportation Research Board, National Research Council,
2003, “Oil in the sea III: Inputs, fates, and effects”, The National Academics Press, 2003, ISBN: 0-309-
08438-5.
[92] BAASP, 2003, “Annual Report on Aerial Surveillance for 2003”, Bonn Agreement Aerial
Surveillance Programme (BAASP), 2003. Available online at:
http://www.bonnagreement.org/eng/doc/Aerial_Surveillance_Report_for_2003.zip
[93] ITOPF, 2005, “Oil tanker spill statistics: 2004”, International Tanker Owners Pollutions
Federation Limited, 2005. Available online at: http://www.itopf.com/stats04.pdf
[94] Huijer, K., 2005, “Trends in Oil Spills from Tanker Ships 1995 – 2004”, proc. of the 28th Arctic
and Marine Oilspill Program (AMOP) Technical Seminar, 2005.
[95] INTERTANKO, 2005, “Tanker Facts 2005”, Available online at:
http://www.intertanko.com/tankerfacts/factsheet/fact.pdf
[96] ITOPF, 2005, “The cost of oil spills”, International Tanker Owners Pollution Federation Limited,
2005. Online: http://www.itopf.com/costs.html
[97] ITOPF, 2005, “Case histories”, International Tanker Owners Pollution Federation Limited, 2005.
Online: http://www.itopf.com/casehistories.html

D.4.5.2
[98] Environment Canada, 2005, “Worldwide Tanker Spill Database”, Environment Canada,
Environmental Technology Centre, 2005. Available online at: http://www.etc-
cte.ec.gc.ca/databases/TankerSpills/Default.aspx
[99] Jean-Hansen, V., 2003, “Skipstrafikken i området Lofoten – Barentshavet”, Kystverket,
Transportøkonomisk institutt, 644/2003 (in Norwegian), 2003, ISBN: 82-480-0341-8.
[100] White, I. C. and Molloy, F., 2003, “Factors that Determine the Cost of Oil Spills”, proc.
International Oil Spill Conference 2003.
[101] Monnier, I., 1994, “The Costs of Oil Spills after Tanker Incidents”, DNV research report no. 94-
2024, Det Norske Veritas, 1994.
[102] Søfartsstyrelsen og Farvandsvæsenet, 2002, “Risikovurdering af sejladssikkerheden i de danske
farvande”, dokument nummer P-054380 (in Danish). Available online at:
http://soefart.inforce.dk/graphics/Synkron-Library/Sofartsstyrelsen/Publikationer/Sejladssikkerhed.pdf
[103] DMA and RDANH, 2002, “Risk Analysis of Navigational Safety in Danish Waters”, Danish
Maritime Authority and Royal Danish Administration of Navigation and Hydrography, Report no. P-
054380-2, 2002. Available online at: http://soefart.inforce.dk/graphics/Synkron-
Library/Sofartsstyrelsen/Publikationer/Summary1.pdf
[104] Vazquez, M.X., Varela, M. and Prada, A., 2003, “Economic effects of the Prestige catastrophe.
An advance”, International scientific seminar, Economic, social and environmental effects of the
“Prestige” oil spill, Santiago, 2003.
[105] Endresen, Ø., Sørgård, E., Sundet, J. K., Dalsøren, S. B., Isaksen, I. S. A., Berglen, T. F. and
Gravir, G., 2003, “Emission from international sea transportation and environmental impact”, Journal of
Geophysical Research, vol. 108, No. D17, 4560.
[106] Endresen, Ø., Behrens, H. L., Brynestad, S., Andersen, A. B., Skjong, R., 2004, “Challenges in
global ballast water management” Marine Pollution Bulletin 48 (2004).
[107] NOAA, 2006, “Habitat equivalency analysis: an overview”, National Oceanic and Atmospheric
Administration.
[108] McCay, D. F., Fowe, J. J., Whittier, N., Sankaranarayanan, S., Etkin, D. S., 2004, ”Estimation of
potential impacts and natural resource damages of oil”, Journal of Hazardous Materials, Vol. 107.
[109] Etkin, D.S., 2004, “Modelling oil spill response and damage costs”, Proc of 2004 freshwater
spills symposium.
[110] French-McCay, D. P., 2004, “Oil spill impact modelling: development and validation”,
Environmental Toxicology and Chemistry, Vol. 23, issue 10.
[111] Lui, X. and Wirtz, K. W., 2006 “Total oil spill costs and compensations“, Maritime Policy &
Management, Vol. 33, No 1.
[112] Helton, D. and Penn, T., 1999 “Putting response and natural resource damage costs in
perspective”, Proc of the 1999 international oil spill conference.
[113] US Congress, 1990, “An Act To establish limitations on liability for damages resulting from oil
pollution, to establish a fund for the payment of compensation for such damages, and for other
purposes.”, One Hundred First Congress of the United States of America, at the second session, 1990.
Available online at: http://www.uscg.mil/hq/g-m/nmc/response/opawordp.pdf
[114] EU, 2002, “Regulation (EC) No 417/2002 of the European Parliament and of the Council of 18
February 2002 on the accelerated phasing-in of double hull or equivalent design requirements for single
hull oil tankers and repealing Council Regulation (EC) No 2978/94”, European Union’s Regulation
417/2002, 2002. http://europa.eu.int/eur-lex/pri/en/oj/dat/2002/l_064/l_06420020307en00010005.pdf

D.4.5.2
[115] EU, 2003, “Regulation (EC) No 1726/2003 of the European Parliament and of the Council of 22
July 2003 amending Regulation (EC) 417/2002 on the accelerated phasing-in of double-hull or equivalent
design requirements for single-hull oil tankers”, European Union’s Regulation 1726/2003, 2003.
Available online at: http://europa.eu.int/eur-lex/pri/en/oj/dat/2003/l_249/l_24920031001en00010004.pdf
[116] US DoT, 2001, “OPA 90 Programmatic Regulatory Assessment (PRA) – Benefit, Cost and Cost
Effectiveness of Eleven Major Rulemakings of the Oil Pollution Act of 1990”, U.S. Department of
Transport, 2001.
[117] Committee on Tank Vessel Design, National Research Council, 1991, “Tanker Spills: Prevention
by Design”, The National Academics Press, 1991, ISBN: 0-309-04377-8.
[118] US DoD, 2000, “Standard practice for system safety”, U. S. Department of Defence, Military
Standard, MIL-STD-882D, 2000.
[119] SOLAS, 2001, “SOLAS amendments 2000”, IMO, 2001, ISBN: 92-801-5110-X.
[120] MSC/Circ. 1033, 2002, “Interim guidelines for evacuation analyses for new and existing
passenger ships”, IMO, 2002.
[121] MSC/Circ. 1002, 2001, “Guidelines on alternative design and arrangements for fire safety”, IMO,
2001.
[122] Vanem, E. and Skjong, R., 2004, “Fire and evacuation risk assessment for passenger ships”, proc.
of 10th International Fire Science & Engineering Conference, Interflam, 2004.
[123] Vanem, E., and Skjong, R., 2004, Collision and Grounding of Passenger Ships – Risk Assessment
and Emergency Evacuations”, proc. of 3rd International Conference on Collision and Grounding of Ships,
ICCGS, 2004.
[124] MSC/Circ. 574, 1991, “The calculation procedure to assess the survivability characteristics of
existing Ro-Ro passenger ships when using a simplified method based upon Resolution A.265(VIII)”,
IMO, 1991.
[125] SLF 46/INF.5, 2003, “Development of revised SOLAS chapter II-1 parts A, B and B-1 –
Evaluation of Required Subdivision Index R for Passenger and Dry Cargo Ships – Report from the
research project HARDER”, submitted by Norway and the United Kingdom, IMO, 2003.
[126] SLF 45/3/5, 2002, “Development of revised SOLAS chapter II-1, parts A, B and B-1 -
Investigations and proposed formulations for the factor “p”, “r” and “v”: the probability of damage to a
particular compartment or compartments – Report from the research project HARDER”, submitted by
Norway and the United Kingdom, IMO, 2002.
[127] Rusås, S. and Skjong, R., 2004, “Damage stability standards in a total safety regime”, proc. of the
10th International Symposium on Practical Design of Ships and other Floating Structures, PRADS, 2004.
[128] Olufsen, O., Spouge, J. and Hovem, L., 2003, “The formal safety assessment methodology
applied to the survival capability of passenger ships”, proc. RINA Passenger Ship Safety Conference,
2003.
[129] HSC Code, 2000, “International Code of Safety for High-Speed Craft (HSC) Code, 2000
edition”, IMO, 2000, ISBN: 92-801-5122-3.
[130] MSC 73/21/Add.1, 2000, “Report of the Maritime Safety Committee on its seventy-third session.
Annex 5 – Resolution MSC.97(73) – Adoption of the International Code of Safety for high-speed craft,
2000”, IMO, 2000.
[131] Paté-Cornell, M.E., “Discounting in Risk Analysis: Capital vs. Human Safety”, Risk, Structural
Engineering and Human Error, Waterloo, Ontario, Canada, p. 17-32, 1983.

D.4.5.2
Annex A: Descriptions of risk control options

This appendix provides a short description of the risk control options discussed in Table 4.
Risk control options regarding fore-end watertight integrity of bulk carriers, submitted by IACS in
MSC 74/5/4 (2001)
RCO 1: Enhancement of strength of transverse bulkheads to ensure that it will be sufficient to sustain the
water pressure caused by flooding of any one cargo hold.
RCO 2: Speeding up the implementation of SOLAS chapter XII: Additional safety measures for bulk
carriers by using 10 years as threshold instead of 15 years.
RCO 3a, b: Increasing the minimum permitted freeboard on capesize bulk carriers with hatch covers
designed according to ILLC 66 with 0.5 and 1.5 meters respectively. The minimum permitted freeboard is
allotted to ensure a sufficient reserve of buoyancy to accommodate damage and flooding and increased
freeboard will provide increased reserve buoyancy. Selecting 1.5 meter increased freeboard would imply
the hatch cover reliability of these ships approximately equal to the hatch cover reliability of IACS UR
S21 designs. In addition, the risk control option will give a lower annual probability of fore end flooding,
hatch cover failure, and side shell failure. An alternative risk control option would be to require the subset
of the fleet with hatch covers designed according to ILLC 66 to sail with B freeboard instead of B-60
freeboard. This would correspond to an increase in the freeboard of approximately 0.5 meter. Increasing
the freeboard corresponds to a reduction in the cargo carried.
RCO 4a - d: Coating of internal side skin structure. The most hazardous factor for side shell failure is
corrosion. Side shell failure could thus most effectively be prevented by preventing corrosion. In this
regard, coating of internal single side shell structure is selected as an RCO. Considering effects of ageing
and intervals of re-coating, coating requirements for new-building, 10 year old ship, 15 year old ship and
20 year old ship were investigated.
RCO 5a-d: Water ingress alarm in all cargo holds and the forepeak. This risk control option is
characterised of an alarm signalling water ingress in the forepeak or any cargo hold. The ensuing
components would be needed in the alarm system:
• Sensor, allowing for continuous reading of water level in cargo hold
• Cables
• Ex barriers (if required)
• Alarm central
• Alarm panel
Considering ageing effect, requirements of water ingress alarm in all cargo holds and forepeak for new-
building, 10 year old ship, 15 year old ship and 20 year old ship were investigated.
RCO 6a-c, 7a, b: Double side skin. The introduction of double side skin construction requirements for all
cargo holds were considered for both new-buildings and existing ships, and double side skin requirements
for only cargo holds number 1 and 2 were considered for existing ships in addition. This risk control
option is proposed in order to reduce the risk of side shell failure and to prevent flooding of the cargo
holds.
RCO 8a, b: Construction of a forecastle is intended to increase the watertightness and thus reduce the risk
of forepeak flooding. The risk control option is investigated independently for new-buildings and existing
ships of different sizes.

D.4.5.2
RCO 9a, b: Construction of a bulwark is an alternative risk control option to that of RCO 8 for reducing
the risk of forepeak flooding. The risk control option is investigated independently for new-buildings and
existing ships of different sizes.
RCO 10a, b: Monitoring system for detecting water ingress in the forepeak. The inclusion of a monitoring
system is expected to virtually eliminate the contribution of the human element, where a prompt detection
of the forepeak filling and operation of the pumping system can be effective to prevent escalation. This is
true, however, if the layout is such as to prevent the pumps from being flooded or disabled. A continuous
monitoring is preferable to an alarm, as it is much more user-friendly and allows for a prompter
intervention. The risk control option is investigated independently for new-buildings and existing ships of
different sizes.
RCO 11a-c: Replacement of ILLC 66 hatch covers with IACS UR S21 hatch covers for existing capesize
bulk carriers. This risk control option implies replacing No. 1 and 2 hatch covers designed according to
ILLC 66 with hatch covers designed according to IACS UR S21. This risk control option is proposed to
reduce the risk of hatch cover failure and is investigated for existing capesize bulk carriers at various
ages.
RCO 12a-c: Replacement of IACS UR S21 hatch covers. This risk control option implies replacing No. 1
and 2 hatch covers designed according to IACS UR S21 with hatch covers designed to withstand a 30%
increase in the design loads of IACS UR S21. This risk control option is proposed to reduce the risk of
hatch cover failure and is investigated for existing bulk carriers at various ages.
RCO 13a-d: Hydraulic hatch cover closure system on No. 1 hatch cover. This risk control option implies
fitting No. 1 cargo hold with a hydraulic hatch cover closure system. This risk control option is proposed
to reduce the risk of hatch cover failure and is investigated for new-buildings as well as for existing ships
at different ages.
RCO 14: 30% increase in IACS UR S21 design loads for new ships. This risk control option implies to
design hatch covers to withstand a 30% increase in the design loads of IACS UR S21and is intended to
reduce the risk of hatch cover failure for new ships.
Risk control options regarding life saving appliances for bulk carriers, submitted by Norway and
ICFTU in MSC 74/5/5 (2001)
RCO 15: Sheltered mustering and lifeboat arena. This risk control option should provide safer access to
lifeboats by presenting protection against fires, i.e. heat radiation and smoke, and the environment, i.e.
heavy weather, wind and sea. The muster area will be enclosed with a wall and a deck above the lifeboat,
extending the full length of the lifeboat and a wall in front of the muster area/lifeboat. The risk control
option is meant to reduce the number of fatalities due to unsuccessful boarding, especially in severe
weather.
RCO 16: Remote operation of the ship from the muster area. This risk control option suggests installing
remote operation of the ship from the muster area, i.e. equipment for controlling the steering and
propulsion. The possibility of operating the ship from the muster area in meant to reduce the risk due to
untimely decision to muster.
RCO 17: Water level alarm. IACS UR S24 requires water level alarms no later than the first intermediate
or the first special survey, to be held after 1 January 1999 whichever comes first. (Water level alarms in
all holds - no continuous water level indicator.) This risk control option suggests a continuous water level
indicator, as this is not adding much to the costs (the cabling and protection of the alarm is the main cost).
The advantage of an indicator based on measuring hydrostatic pressure is that the master is actually going

D.4.5.2
to understand that the scenario is developing. With an alarm (light/sound) the master may still be having
the problem of deciding if the scenario is developing, or the alarm is false. It is believed that continuous
display of water ingress is a much better indication than an alarm.
RCO 18: Immersion suits to all personnel. The provision of immersion suits fitter to each individual will
increase the survival time for personnel submerged in the sea and hence the chances of being rescued.
The survival time for personnel in immersion suits in water temperatures above 5° C is more than 12
hours compared to less than one hour in normal clothing. This is assumed to make a significant difference
to the chances of being rescued as it greatly enhances the likelihood that other ships may come to assist
within the critical time.
RCO 19: Free-fall lifeboat. This risk control option should provide for more swift abandonment of the
ship and thus reduce the risk associated with evacuation. The preparation phase is very short for free-fall
lifeboats and will thus provide for more rapid evacuation than conventional life boats.
RCO 20, 21: Free-fall lifeboat with free float mode. This risk control option is similar to RCO 19, but
with the addition of free float mode of the free-fall lifeboats by equipping them with a hydrostatic release
mechanism. The free float mode will allow the lifeboats to be released automatically as the ship sinks in
collision, grounding and foundering scenarios and will hence reduce the risk of fatalities due to untimely
decision to launch.
RCO 22: Pick-up crane. This risk control option implies installation or modification of a crane for easier
pick up of lifeboats and rafts. In order for this risk control option to reduce the risk notably, the ship
involved in the rescue need to be equipped with such a pick up facility. This would in reality correspond
to implementation on all ships, not only bulk carriers in order to reduce the probability of fatalities on
bulk carriers.
RCO 23: Enclosing lifeboats for all existing ships. The requirement of enclosed lifeboats was enforced in
1986, and is believed to have reduced the probability of fatality for all types of scenarios significantly.
The effect of this risk control option is believed to benefit the fleet of bulk carriers built before 1986 for
about 5 years. It is also noted that the potential loss of lives is increasing greatly during the last years in a
bulk carrier’s lifetime, and that these old ships would benefit from this risk control option.
RCO 24: Redundant trained personnel. This risk control option would require more than one person to
attend safety training packages such as a combined lifeboat and fast rescue boat course. Requiring
redundancy in trained personnel is assumed to result in reductions in the probability of unsuccessful
preparation of emergency equipment such as lifeboats and liferafts.
RCO 25, 26: Two conventional lifeboats and throw overboard life rafts respectively. Implementation of
these risk control option are decisions previously made by IMO. An analysis of cost effectiveness of these
current life saving appliances is meant to represent an implicit willingness to pay for safety and is
included for the sake of comparison and in order to check for agreement with suggested figures for
acceptance criteria.
Risk control options regarding bulk carrier safety, submitted by Japan in MSC 75/5/2 (2002)
RCO 27, 28, 30: Corrosion control of hold frame. These risk control options seeks to reduce the risk of
flooding due to corrosion of hold frames. Various ways of controlling the corrosion of hold frames are
proposed, i.e. increase of corrosion margin, application of enhanced corrosion allowance and severely
control of paint condition. The different risk control options is evaluated independently for both new-
buildings and existing ships of various sizes and for existing ships that comply with SOLAS chapter XII

D.4.5.2
for new-buildings and with SOLAS chapter XII for existing ships. These risk control options are referred
to as RCO16, RCO51 and RCO52 in the FSA report submitted to IMO.
RCO 29a, b: Application of SOLAS chapter XII to ships less than 150 meters in length and for those of
double side skin construction. Many of the regulations contained in SOLAS chapter XII, “Additional
safety measures for bulk carriers” apply only for ships more than 150 meters in length of single side skin
construction. These risk control options suggest expanding the scope of these regulations to also include
smaller bulk carriers and bulk carriers of double side skin construction in order to enhance the safety level
of those vessels. The risk control option is investigated for new-buildings and existing ships
independently. These risk control options are referred to as RCO10, RCO11, RCO20 and RCO21 in the
FSA report submitted to IMO.
RCO 31a, b: Application of double side skin. This risk control option aims at reducing the risk of
flooding into the cargo holds by introducing double sided skin on bulk carriers. The risk control options
are evaluated independently for new-buildings and for existing ships and for ships of both less than and
more than 150 meters in length. For existing ships, application of double side skin in only cargo holds No
1 and 2 were considered in addition to application in all holds. These risk control options are referred to
as RCO15, RCO25a, and RCO25b in the FSA report submitted to IMO.
RCO 32: Application of IACS unified requirements S 21 to existing ships. IACS unified requirements
S21 regards requirements of hatch cover strength and is, in addition to the relevant requirements of the
ICCL 66, the current design standard for the evaluation of scantlings of hatch covers of bulk carriers’
cargo hold, applicable for vessels constructed since 1998. The risk control option proposes to make these
requirements applicable also to existing ships where they are currently not applicable. The risk control
option is investigated independently for existing ships of more than and less than 150 meters in length
and for existing bulk carriers of double side skin construction. The risk control option is referred to as
RCO23 in the FSA report submitted to IMO.
Risk control options regarding hatch covers of bulk carriers, submitted by the United Kingdom in
MSC 76/5/3 (2002)
RCO 33-34: Implementation of IACS UR S21 on existing hatch covers. This risk control option is similar
to RCO 32, and it is evaluated independently for ships of different ages. Furthermore, two alternative
ways of implementing IACS UR S21 are considered, namely by replacement and by reinforcement of
existing hatch covers. These risk control options are referred to as RCO1-a and RCO1-b in the FSA report
submitted to IMO.
RCO 35-36: Hatch covers strength 30% above the requirements of IACS UR S21. This risk control
option is similar to RCOs 33-34, but suggests increasing the hatch cover strength to 30% above the
requirements of IACS UR S21. Ships at different ages are considered and both replacement and
reinforcement of existing hatch covers are investigated. These risk control options are referred to as
RCO2-a and RCO2-b in the FSA report submitted to IMO.
Risk control options regarding bulk carrier safety from the international collaborative FSA study,
submitted by the United Kingdom in MSC 76/5/5 (2002) and described in MSC 76/INF.8 (2002)
RCO 37: Increase hatch cover strength to resist vertical forces. The function of this risk control option is
to reduce the probability of hatch cover failure due to the effects of the sea, in terms of its vertical
component of force, both in the intact and damaged conditions. It is recommended that existing minimum
strength standard (UR S21) should be increased by 30 – 40 % by increasing the scantlings of the hatch
covers. The effect on both new-buildings and existing ships were investigated. This risk control option is
similar to RCO 35-36 described above, and is referred to as RCO A1 in the FSA report submitted to IMO.

D.4.5.2
RCO 38: Hatch cover design. This risk control option proposes to analyse forces and redesign hatch
covers to incorporate mitigating features. The design of hatch covers should be developed to counter
horizontal forces, ballast hold sloshing forces, means for topping up ballast holds and additional cleats as
a standard feature. This risk control option is motivated by tank tests that identified larger than expected
loads associated with horizontal components in green water forces and is also aimed at securing devices
for preventing movements. The risk control option is fulfilled by providing additional longitudinal and
transverse restraints on each cargo hatchway, with strengthened bolts for the water ballast hatch. The
effect of this risk control option was studied for both existing ships and new-buildings of different sizes.
This risk control option is referred to as RCO A3 in the FSA report submitted to IMO.
RCO 39: Improved coating system. The function of this risk control option is to provide greater
protection against corrosion to the hatchway cover. It is recommended that hatch covers be fully coated
on all external surfaces, including those normally on the lower face. The plates are to be coated both
before and after fabrication. Controls and/or performance standards for protective coatings linked to
strength limitations are proposed, with the introduction of a certificate of fitness linked to the types of
cargos that are allowable. This risk control option is referred to as RCO A6/B7 in the FSA report
submitted to IMO, and was investigated for both new-buildings and existing ships of different sizes.
RCO 40: Improved crew/stevedore training. The evaluated risk control option is a conjunction of two
related risk control options, namely improved crew training and improved stevedore training. Stevedore
training and additional training for bulk carrier sea staff are proposed in order to enhance the competence
and thus reduce the risk. It is recognized that damage caused in port can be contributory to structure
failure, and the function of this risk control option is to ensure that terminal employees involved with the
shore-ship interface interact with the bulk carrier in an appropriate way without imposing significant risk
on the ship and its crew. Bulk carrier endorsement to STCW28 certification and accredited training for
drivers of cranes etc associated with shipboard work from shore are proposed. The risk control option is
investigated for both new-buildings and existing ships of different types. This risk control option is
referred to as RCO A16 and seen in conjunction with RCOs A14 and A25 in the FSA report submitted to
IMO.
RCO 41: Positive indication of secured or unsecured openings. This risk control option is meant to
provide those charged with the securing of cargo hatchways with a confirmation that the task has been
successfully completed and to provide early warning of potential cargo hatchway failure. Each cargo
hatchway cover should be fitted with visual and audible indicators to positively identify that all are in
watertight condition, using alarms in permanently manned space. The risk control option was evaluated
for both new-buildings and existing ships of various sizes and is referred to as RCO A20 in the FSA
report submitted to IMO.
RCO 42: Port State Control inspector training. This risk control option suggests providing specialised
training in bulk carrier design and operation with an emphasis on areas of high vulnerability to PSC
inspectors. It should ensure that those appointed to conduct PSC inspections are fully versed in those
aspects of the design, construction and operation that have the greatest influence on the overall risk. The
risk control option was evaluated for both new-buildings and existing ships of various sizes and is
referred to as RCO A24 in the FSA report submitted to IMO.
RCO 43: Enhanced survey and inspection. This risk control option aims at taking forward and enhancing
a holistic approach towards the superintendence and maintenance of the ship structure by targeting
inspections at areas of high risk. The ship’s structural monitoring system should cover onboard aspects of
survey, and survey results should be supported by photographic evidence. Furthermore, it is suggested to
28
Standards of Training, Certification and Watchkeeping for Seafarers.

D.4.5.2
update the regulatory regime for improved monitoring of side shell. The risk control option was evaluated
for both new-buildings and existing ships of various sizes and is referred to as RCO A25 and B6 in the
FSA report submitted to IMO.
RCO 44: Weather routing. This risk control option aims at reducing bulk carrier accidents influenced by
green seas and wave impacts on side shell. It is recommended to enhance the supply of meteorological
information to bulk carriers and to establish international standards for the provision of weather routeing
services to bulk carriers. Weather routeing is currently available as a commercial service that seeks to
optimise weather on passage by the route taken and only the commercial aspects are currently exploited.
Guidelines to support the master’s decision making on grounds of safety are not available, and the service
are yet unregulated. The risk control option proposes standardised minimum requirements, and the effect
on both new-buildings and existing ships of various sizes are considered. The risk control option is
referred to as RCO A26 in the FSA report submitted to IMO.
RCO 45: Introduce double hull. This risk control option is similar to RCO 6, 7 and 31 and is meant to
provide essential protection and strengthening to the part of the hull of the bulk carrier that is the
dominant contributor to the overall risks involved in operation, namely side shell failure. It is suggested
that those areas of the ship’s internal cargo carrying structure that are presently provided with a single
barrier against water ingress should receive enhanced protection in the form of an additional barrier. The
risk control option fundamentally assumes that hull strength overall is increased and that material is not
removed from the other areas of the design to form a double skin with the same lightweight as a single
side skin bulk carrier. The effect of this risk control option on both existing ships and new-buildings have
been examined for various ship types, and the risk control option is referred to as RCO B5 in the FSA
report submitted to IMO.
RCO 46: Mandate BC code + link to standards for protective coating. This risk control option should
ensure that cargos carried are compatible with protective coatings applied to a particular vessel and to link
issues impacting upon hull performance with operational procedures. A mandatory BC code is suggested,
i.e. it is recommended to apply a general certificate of fitness to the carriage of all dry cargo in bulk,
similar to that already applied to bulk carriers engaged in the carriage of grain. This would clarify the
suitability of a particular vessel to transport the proposed cargo. The risk control option is evaluated for
new-buildings and existing ships for Panamax type bulk carriers only, and it is assumed that the
conclusions will be of generic validity. The risk control option is referred to as RCO B8 in the FSA report
submitted to IMO, and it is linked to RCOs A6 and B7.
RCO 47: Ban alternate hold loading of heavy cargo. It is recommended to proscribe alternate hold loading
of heavy cargo through IMO regulation in order to reduce the stress imposed on the hull during the
carriage of dense cargos. The risk control option is only evaluated for Panamax type bulk carriers, both
new-buildings and existing ships, and the conclusions is deemed applicable to generic bulk carriers. The
risk control option is referred to as RCO B9 in the FSA report submitted to IMO.
RCO 48: Improve control on steel repair. The purpose of this risk control option is to reduce the risk of
bulk carriers sailing with innate defects and to reduce the risk of failure on voyages subsequent to repairs
done incorrectly and with wrong materials. It is recommended to establish an international standard of
steel repairs ensuring that repairs are performed using correct grade steels and welding rods and that
plates are coloured according to grade of steel. It is recommended that key decision-makers are reminded
of their existing obligations to ensure all repairs are undertaken to the required standards. The risk control
option is referred to as RCO B10 in the FSA report submitted to IMO, and it is evaluated for both new-
buildings and existing ships of various types.
RCO 49: Improve ship/shore communications. This risk control option suggests setting a minimum
standard of communication between ship and shore, identified during human element studies as pivotal to

D.4.5.2
effective operations. The effect of this risk control option was examined for both new-buildings and
existing ships of different sizes, and it is referred to as RCO C8 in the FSA report submitted to IMO.
RCO 50: Free-fall (float free) lifeboat. This risk control option is the same as RCOs 19, 20 and 21
discussed above and should provide the means for crew to rapidly evacuate the ship, taking into account
the rapid escalation of the events leading to eventual sinking. It was recommended to supplement or
replace existing life saving appliance technology with a free-fall design that would enable the crew to
safely evacuate within the time expected to be available. The cost and benefit for this risk control option
was only evaluated for Panamax, new and existing, but the conclusions were assumed to be applicable for
other types of bulk carriers as well. In the FSA report submitted to IMO, this risk control option is
referred to as RCO E1.
Risk control options regarding navigational safety of large passenger ships, submitted by Norway
in NAV 50/11/1 (2004)
RCO 51: The navigational bridge is a “continuously manned central control station”, as defined in
SOLAS, and the bridge therefore has a number of functions that are not related to navigation. These non-
navigational functions might take away the attention towards navigation from the OOW. Some of the
non-navigational functions relates to fire safety system, damage control equipment, decision support
system and non-navigational external communication. The non-navigational functions could be
reorganised into a continuously manned safety centre, located separately from the bridge. The centre
could for example be located close to the hotel reception, which is already continuously manned. The
operation of such a centre would require one additional OOW at any given time.
RCO 52: SOLAS specifies the type and frequency of necessary entries into a vessel’s deck log book.
Such entries involve almost all operations taking place onboard the vessel (route details, entering and
leaving port, watch information, drills carried out, etc.). The task of manually entering data into the deck
log book is somewhat time-consuming, and could result in distractions for the operating officer from his
observation duties. A number of the required entries into the deck log book could be done automatically,
without interference of human presence, by adopting an electronic log book. Such a system is based on IT
technology, and replaces paper versions of log books. The system will be online with most of the bridge’s
navigational equipment and other vital sensors for the vessel’s operation, providing automatic entry of
chosen online information, either continuously or on predetermined time intervals.
RCO 53: The minimum safe manning of the bridge is regulated by IMO resolution A.890 (21). The
resolution defines minimum safe manning for navigation as being able to plan and conduct safe
navigation, maintain a safe navigational watch, manoeuvre and handle the ship under all conditions, moor
and unmoor the ship safely. The resolution calls for one navigational officer and one lookout on the
bridge. However, the manning in the cruise industry is most commonly to have two navigational officers
on watch, and one extra watch in difficult or critical situations, e.g. congested areas. Typically, the tasks
and responsibilities are clearly defined by having one officer to focus on navigating the vessel in the
waters and one to focus on the traffic situation in the area or other tasks that have to be taken care of. The
risk for navigational mistakes is reduced by having two officers compared to one officer on watch. One
additional officer on watch requires 6 extra officers per ship, 3 onboard and 3 onshore at any given time.
The officers onboard will require 3 additional officers’ cabins, which would reduce the number of
passenger cabins by 3.
RCO 54a, b: Electronic Chart Display and Information System (ECDIS) is a navigation aid that can be
used instead of nautical paper charts and publications to plan and display the ship’s route, plot and
monitor positions throughout the intended voyage. ECDIS is a real-time geographic information system.
It is capable of continuously determining a vessel’s position in relation to land, charted objects,
navigational aids, possible unseen hazards, and represents a new approach to maritime navigation. In

D.4.5.2
daily navigational operations, it should reduce the workload of the navigating officers compared to using
paper charts. Route planning, monitoring and positioning will be performed in a more convenient and
continuously real time way, enabling the navigator to have a continuous overview of the situation. ECDIS
is a sophisticated electronic navigation system, which is possible to integrate with both the radar system
and Automatic Identification System (AIS). The ECDIS is thus a powerful navigational tool, which has
proved to have a high risk reducing effect. This RCO was evaluated in two different manners: a) With
ECDIS and track control compared to the risk level without ECDIS and track control and b) Without
track control. The RCO has been tested by comparing with ECDIS and without ECDIS.
RCO 55: An Automatic Identification System (AIS) is designed to send and receive information in
relation with a vessel’s identity (e.g. name, call sign, and dimensions), course (e.g. route, speed) and
cargo. Current regulations, implemented mainly for security reasons, require the information to be
presented into an AIS display. The most common type of installed display (minimum required) provides
three lines of data consisting of basic information of a selected target (name, range and bearing).
Additional information regarding the target can be provided by scrolling. A huge amount of information
received by the AIS is hidden behind the small display, and it is time consuming and distractive for the
navigator to search for the information. The AIS can be connected to the radar’s ARPA (Automatic Radar
Plotting Aid) function, and provide all the additional “hidden” data into the radar display. By selecting an
AIS target into the ARPA display, the navigator will be able to see all available information for the
particular vessel. Besides the easier access of AIS information through the ARPA, there are five more
areas where the AIS integration improves the radar performance: Detection of targets which are in radar
shadow areas, identification of radar targets into ship’s names, takes account of the ships rate of turn, in
some cases extents radar’s range, clarifies the target intentions. AIS can become a useful source of
supplementary information and an important tool in enhancing situation awareness of the traffic
conditions. Benefits deriving from the AIS-ARPA interface, will improve the navigator’s ability to make
early decisions based on real-time data, and avoid potential collisions.
RCO 56: Track control and track keeping systems were developed on the basis of continuously
comparing the vessel’s actual course, with the originally planned one. The route of the vessel is planned
before departure and is entered in the track control system. Through real time information from
navigational equipment, the system ensures that the planned route is followed. In case a deviation occurs,
an e.g. due to environmental force, the vessel is automatically corrected to follow the track. The basic
philosophy for developing track control systems is that a vessel can not run aground if the route is
properly planned and the ship follows the route for the entire voyage. Even though this is a powerful tool,
the navigator has of course to ensure that the plotted track is actually followed. Implementation of track
control systems will also liberate more time for the operating officer to monitor traffic conditions.
RCO 57a, b: Improved bridge design was decided to be one of the most important RCOs during the
HAZID process, with navigation experts. By the term “improved”, it is implied upgrading from a
standard/minimum SOLAS bridge, which is equipped the minimum required equipment and which gives
very limited requirements regarding the bridge layout. It is common for cruise vessels to go beyond the
minimum required standards in relation to bridge design, and to upgrade to a more sophisticated level.
The degree of this upgrading depends on the policy of each cruise vessel operator. In order to quantify
“improved bridge design” and the degree of the upgrading, DNV’s voluntary class notation NAUT-AW is
used for description as input to the cost benefit assessment. The aim for developing DNV Rules for
nautical safety was to reduce the probability of a failure, caused by any reason, within the bridge team
and therefore enhance safety. NAUT-AW or similar, as an addition to the SOLAS requirements, regulates
the following sectors: Design of the workspace and the bridge layout, navigational equipment and man-
machine interface. As a result of implementing NAUT-AW or similar, the efficient performance of all
navigation related tasks as well as good co-operation within the bridge team is enhanced by improved
bridge design to enable efficient management of all operating conditions of the vessel. The following
aspects of improved bridge design are included: bridge layout and workstation arrangement, task specific

D.4.5.2
workstations, design and ergonomics of workstations including location of instruments, field of vision
from workstations, bridge physical working environment.
RCO 58: The basic training requirements for the navigators are defined in the International Convention
on Standards of Training, Certification and Watch-keeping for Seafarers (STCW). STCW defines training
the navigators should have and how often they need to take refreshment training. The requirements cover
all basic navigational skills. The training as required by STCW is a minimum, and it is further assessed
that improved navigator training would have positive effect on the safety level of the vessel. An example
of improved navigator training is advanced ship manoeuvring, including training of crisis situations
which can only be done safely in simulators. The training should be carried out with simulators to give
realistic experience of situations and thus preparing the navigators in case they face a similar incident.
RCO 59: Bridge Resource Management (BRM) is designed to ensure efficient use of personnel and
equipment during vessel operations. BRM is designed to reduce errors and omissions in bridge operations
through a simple system of checks and delegation of duties. BRM system emphasises a coordinated effort
among bridge personnel to ensure smooth, efficient and safe operation of the vessel. The 1995
amendments to the STCW include a requirement for training in bridge team procedures and a
recommendation for training in BRM techniques. The implementation of BRM is assumed to involve
initial preparations of procedures to be followed and definition of relevant responsibilities. In addition,
the bridge teams are assumed to go through a BRM course to assist the implementation. For
communication and responsibilities that are connected to the onshore personnel, such training should also
include key onshore personnel.
RCO 60: The navigational systems availability is assumed mainly to be influenced by the redundancy of
the navigational components. The interface between different systems might also be a problem, especially
software interfaces, but this problem has not been addressed here. The navigational equipment, as
required by SOLAS, is mostly redundant on standard bridges today. The important exceptions are the
gyroscopic compass and the Global Positioning System (GPS). These items are not required to be
duplicated and therefore they are most often not. Improved navigational systems availability is here
defined as installation of one extra gyroscopic compass and one extra GPS.
The estimation of cost effectiveness was carried out for a ship with a total of 5,000 passengers and crew
on board, and a required index R of 0.9 was assumed. This is the required index proposed in Norway and
UK (2003). As the risk in collision is proportional to (1-R) and the collision risk is dominating all risk
control options would become cost effective with an R below 0.7.

D.4.5.2

D.4.5.2
Annex B: FN based acceptance criteria
The following FN diagrams are in use in The Netherlands (VROM), UK (HSE), Hong Kong and
Denmark (Suddle, 2003). Note that ALARA stands for “As Low As Reasonable Achievable”, which in
practice has the same meaning as As Low As Reasonably Practicable (ALARP). From these figures, it is
clear that the Dutch societal criteria (also known as the VROM rule) are extremely strict if applied to e.g.
passenger ships. The Hong Kong criteria would simply forbid ships with more that 1,000 people on
board. Both the VROM and Danish diagram is extremely adverse against accidents with possibilities for
many fatalities.
Figure 23: FN based acceptance criteria
References Annex B
Suddle, SI (2003) ‘A logarithmic approach for individual ris: the safety index approach’, proc. Of ESREL
2003

D.4.5.2

D.4.5.2
Annex C: Method for deriving societal risk criteria
The evaluation criteria may be associated with the economic importance of the activity in question, and
calibrated against the average fatality rate per unit economic production. The importance of an activity
may be measured most adequately in economic terms, assuming that what is paid in an open market
represents the importance. Similarly, Gross National Product (GNP29) is an aggregated indicator of the
economic activity. Societal risk associated with an activity may be accepted according to the importance
to society of the activity.
For occupational accidents the aggregated indicator, q , may be defined as the average fatality rate per
GNP. For transport related accidents a similar aggregated indicator, r ,may be defined.
Number of occupational fatalities to establish risk evaluation criteria for crew

q=
GNP
Number of fatalities due to transportation to establish risk evaluation criteria for
r=
Contribution to GNP from transportation passengers
By using data from US and Norway on occupational fatalities q = 1.0 fatalities/$ billion may be
estimated for the occupational fatalities and r = 5.73 fatalities/$ billion may be estimated from statistics
for scheduled air traffic (ICAO, 1995; Norway (2000), Skjong and Eknes, 2001, 2002). Air traffic is
selected for comparison because of the availability of good statistics, and the generally high safety
standards.
For a specific activity (e.g. a ship), an average acceptable Potential Loss of Life ( PLL A ) may be based on
the Economic Value (EV) of the activity.
PLL A = q ⋅ EV for crew/workers or PLL A = r ⋅ EV for passengers. (C.1)
This states that largely the total occupational risk should be distributed between the different activities
accounting for their contribution to GNP, and that large deviations from this should be judged an
indication of good reasons for scrutiny. A similar criterion should be established for a transport activity.
For activities and trades, which are of less importance to the society, the society may not be willing to
accept a high accidental fatality risk. For activities and trades of minor significance, and with minor
contribution to the service production, only minor risks should be accepted. As the ultimate solution the
fatality risk may be eliminated, by eliminating the activity itself. This way a safety budget would be
established. E.g. a low economic importance corresponds to a low PLLA.
FN curves are commonly regarded as useful tools. An FN curve with inclination b on log-log scale may
be fitted to the resulting PLL A by:
N u −1
Nu
1 ( N + 1) b − N b
PLL A = ∑ Nf N =F1 ( b −1
+ ∑ b −1 ) (C.2)
N =1 Nu N =1 N ( N + 1) b
Here Nu is the upper limit of the number of fatalities that may occur in one accident. For
a ship this is well defined as the maximum number of crew/passengers
fN is the frequency of occurrence of an accident involving N fatalities
and F1 is the frequency of accidents involving one or more fatalities
29
GNP = An estimate of the total money value of all the final goods and services produced in a given one-year period by the
factor of production owned by a particular country's residents

D.4.5.2
Following the recommendation by HSC (1991), HCGPD (1983), Statoil (1995), b =1 is chosen, and the
above simplifies to:
N u −1
1 Nu
1
PLL A = F1 (1 + ∑ ) = F1 ∑ (C.3)
N =1 N + 1 N =1 N
Some risk analysis practitioners are of the opinion that b =1 is not risk averse. This is wrong, as explained
in details in HSE (1991). The risk aversion may be understood by observing that small contributions to
PLL come from large N. Since these small contributions are as ‘intolerable’ as the comparable large
contributions from small N, the b=1 is risk averse.
If solved with respect to F1, Equation (C.3) gives
PLL A
F1 = (C.4)
Nu
1
∑
N =1 N
The ALARP region is introduced by assuming that the risk is intolerable if more than one order of
magnitude above the average acceptable and negligible (broadly acceptable) if more than one order of
magnitude below the average acceptable. This implies that the region where risks should be reduced to As
Low As Reasonably Practicable (ALARP) ranges over two orders of magnitude, in agreement with many
published FN evaluation criteria, e.g. HSE (1999). HKGPD (1993), Statoil (1995).
References Annex C
1. HKGPD(1983), Hong Kong Government Planning Department “Hong Kong Planning Standards &
Guidelines, Chapter 11, Miscellaneous, Potentially Hazardous Installations”
2. HSC (1991), “Major Hazard Aspects of the Transport of Dangerous Substances”, Health & Safety
Commission, Advisory Committee on Dangerous Substances, HMSO, UK, 1991.
3. HSE(1991) “Quantified Risk Assessment: Its Input to decision Making”
4. HSE (1999) “Reducing Risks, Protecting People”. Discussion document, Health & Safety Executive.
5. ICAO (1995): “Civil Aviation Statistics of the World 1994”. The International Civil Aviation
Organization, 1995. http://www.icao.org
6. Norway (2000) ‘Decision parameters and risk acceptance criteria’, MSC 72/16.
7. Skjong, R. and M. Eknes (2001) “Risk Acceptance and Economic Activity”, ESREL 2001
8. Skjong, R and ML Eknes (2002) “Societal Risk and societal benefits”, Risk Decision and Policy
(2002), vol 7, pp 1-11, Published by Cambridge University Press © 2002.
9. Statoil (1995), “Risk Acceptance Criteria in the Statoil Group”. Doc. no. K/KR-44, Rev. no. 0,
01.05.95, Statoil, Norway.

D.4.5.2
Annex D: Alternative design of oil tankers

The International Convention for the Prevention of Pollution from Ships, 1973, as modified by the
Protocol of 1978 (IMO; 2002) contains prescriptive regulations aimed at preventing oil pollution from
ships carrying oil and oil products. Regulation 13F of Annex I, for example, concerns the prevention of
oil pollution in the event of collision and stranding, and contains structural requirements for e.g. wing
tanks and double bottom for protection of the cargo tank30. However, Regulation 13F(5) states that
alternative design of oil tankers may be accepted provided that at least the same level of protection
against oil pollution in the event of collision and grounding are ensured. The exact text of Regulation
13F(5) of Annex I in MARPOL 73/78 is as follows:
“Other methods of design and construction of oil tankers may also be accepted as
alternatives to the requirements prescribed in paragraph (3)31, provided that such
methods ensure at least the same level of protection against oil pollution in the event of
collision or stranding and are approved in principle by the Marine Environment
Protection Committee (MEPC) based on guidelines developed by the Organization.“
The guidelines referred to in the text are those adopted by resolution MEPC.66(37), but these guidelines
were later revoked and replaced by the revised guidelines in resolution MEPC.110(49) (Annex 16 of
IMO; 2003) adopted by the committee on 18 July 2003. The following will give a brief outline of this
resolution, i.e. of the revised interim guidelines for the approval of alternative methods of design and
construction of oil tankers under regulation 13F(5) of annex I of MARPOL 73/78.
The purpose of the guidelines is to provide an international standard for the evaluation and approval of
alternative methods of design and construction of oil tankers under regulation 13F(5) of Annex I of
MARPOL 73/78. Approval will be given based on environmental performance criteria and the basic idea
is to compare the oil outflow performance in case of collision or stranding of an alternative tanker design
to that of selected reference double-hull designs complying with the prescriptive regulations of regulation
13F(3) of annex I of MARPOL 73/78. The comparison is based on calculation of a pollution-prevention
index, E, and the selected reference double-hull designs will be of favourable oil outflow performance
from the various tanker designs which comply with the prescriptive regulations. Alternative design that
meets these performance criteria will thus ensure the same level of protection against oil pollution in case
of collision and grounding as those designs were approval is granted based on the prescriptive criteria. A
probabilistic methodology and the best available tanker accident damage statistics are utilized in the
calculation of oil outflow, also accounting for the influence tidal changes have on the oil outflow in case
of stranding.
The approval procedure for oil tanker designs not complying with the prescriptive rules contains two
steps. First, the Marine Environment Protection Committee (MEPC) will evaluate and possibly approve
the design concept, based on submitted proposals and supporting documentation from an Administration.
Only design concepts that have been approved in principle by the MEPC are allowed for the construction
of tankers according to regulation 13F(5). When the design concept has been approved according to
regulation 13F(5) by the committee, the next step is approval of the final shipyard design by the Flag
State Administration. Such final approval should be based on compliance with the guidelines in
resolution MEPC.110(49) and all other applicable MARPOL regulations. Survivability considerations
should be included in the evaluation of the final design, although such considerations of the ship’s
survivability will normally not be required in the conceptual approval of an alternative design.
30
Applicable to tankers of 600 dwt and above contracted on or after 6 July 1993.
31
Regulation 13F(3) of Annex I of MARPOL 73/78.

D.4.5.2
The oil outflow analysis

The environmental performance of a tanker design in the event of a collision or stranding accident is
expressed by an oil pollution prevention index E, whish is a non-dimensional function of three
parameters:
• Probability of zero outflow PO / POR

• Mean oil outflow parameter OM / OMR
• Extreme oil outflow parameter OE / OER
PO, OM and OE are the oil outflow parameters for the alternative designs, whereas the additional subscript
R denotes the corresponding parameter for the reference double-hull design of the same cargo oil capacity.
The pollution-prevention index E and its associated performance evaluation criterion take the following
form:
E = k1
PO
+ k2
(0.01 + OMR ) (
k 3 0.025 + OER
)
POR (0.01 + OM ) + (0.025 + OE ) ≥ 1
k1, k2 and k3 are weighting factors with the values 0.5, 0.4 and 0.1 respectively. It can readily be seen
from the equation above that alternative tanker designs with a pollution-prevention index less than 1
corresponds to excessive amounts of oil outflow compared to the reference design based on the
prescriptive rules. Such design alternatives will thus not meet the prevailing performance criteria
regarding prevention of pollution by oil, and the proposal should hence be rejected.
The oil outflow parameters should be calculated in the following way:
n
Probability of zero oil outflow, PO : PO = ∑ PK
i =1
i i
i represents each compartment or group of compartments

Pi accounts for the probability that only the compartment or group of compartments are
breached
Ki = 0 if there is oil outflow from any of the breached cargo spaces in i
= 1 if there is no outflow
n
Pi Oi
Mean oil outflow parameter, OM : OM = ∑ i =1 C
Oi = combined outflow in cubic metre from all cargo spaces breached in i

C = total cargo oil capacity at 98 % tank filling (m3)
n
Pie Oie
Extreme oil outflow parameter, OE : OE = 10 × ∑
i =1 C
The index ie represents the extreme outflow cases, i.e. damage cases falling within the cumulative
probability range between 0.9 and 1.0 when they are arranged according to the guidelines.
The outflow parameters should be calculated independently for collision and stranding accidents and for
stranding calculations, independent calculations for 0 metre and 2.5 metre fall in tide should be performed
D.4.5.2
respectively. The oil outflow parameters to be used in the pollution-prevention index should then be the
following composition of the parameters calculated for the different conditions:
O = 0.4 × OC + 0.6 × (0.7 × OS , T = 0 + 0.3 × OS , T =2.5 )
The indices C and S denote the collision and stranded conditions respectively, and the index T indicates
the tidal conditions for the stranded calculations. The damage probability factors Pi for each damage case
should be determined based on damage density distribution functions specified in the guidelines32.
The oil outflow should be evaluated for all the damage cases, using the prevailing damage probability
distribution functions, and placed in ascending order of oil outflow. The cumulative probability of all
damage cases should then be computed, from the minimum outflow damage case to the maximum
outflow damage case, and the cumulative probability for all damage cases should sum up to be 1.0. The
extreme oil outflow cases will correspond to the damage cases falling within the cumulative range
between 0.9 and 1.0. Oil outflow parameters for reference double-hull designs of various sizes are
provided in the guidelines.
For further details and for an example of the application of the guidelines, reference is made to Annex 16
of IMO (2003).
32
It should be noted that the guidelines states that the damage density distribution functions specified in the
guidelines should be periodically reviewed with the collection of additional statistical material. The damage
statistics used in calculation of the oil outflow parameters should always be the most recent ones.

D.4.5.2

D.4.5.2
Annex E: Risk Matrices
Risk matrices usually define both frequencies of events and consequences in some qualitative or
quantitative way, and combine this in some form of risk index. Sometimes these risk matrixes
contain indications of acceptability. This is not recommended (reference is made to the holistic
principle). However, such risk matrices indicates risk acceptance in a similar way as FN
diagrams. Therefore known risk matrixes are reproduced in this Annex.
Some risk matrixes contains risk indices both for economic, environmental and safety
consequences. This way risk matrixes also indicate which risks are considered equivalent.
IMO guidelines on FSA (7*4 matrix)

Frequency of events:
To facilitate the ranking and validation of ranking, it is generally recommended to define probability and
consequence indices on a logarithmic scale. Table 14 gives an example of logarithmic
frequency/probability Index as suggested in the IMO (2002).
Table 14: Logarithmic frequency index
Consequences:
Table 15 gives an example of a logarithmic severity index, scaled for a maritime safety issue.
Consideration of environmental issues or of passenger vessels may require additional or different
categories.

D.4.5.2
Table 15: Logarithmic severity index

SEVERITY INDEX
SI SEVERITY EFFECTS ON HUMAN SAFETY EFFECTS ON SHIP S
(Equivalent
fatalities)
1 Minor Single or minor injuries Local equipment damage 0.01
2 Significant Multiple or severe injuries Non-severe ship damage 0.1
3 Severe Single fatality or multiple severe injuries Severe damage 1
4 Catastrophic Multiple fatalities Total loss 10
Risk matrix:
Risk matrix is used to assign risk levels to each of the combinations of consequence and frequency of
occurrence of events. The risk levels assigned in the table are effectively measured on a logarithmic scale.
A risk index may therefore be established by adding the probability/frequency and consequence indices:
Risk = Frequency x Consequence

log (Risk) = log (Frequency) + log (Consequence)
An example of risk matrix based on Table 14 and Table 15 is given in Table 16. This matrix defines 10
risk levels (2 to 11).
Table 16: Risk matrix based on frequency and severity matrices

RISK MATRIX
SEVERITY (SI)
1 2 3 4
FI FREQUENCY Minor Significant Severe Catastrophic
7 Frequent 8 9 10 11
6 7 8 9 10
5 Reasonably probable 6 7 8 9
4 5 6 7 8
3 Remote 4 5 6 7
2 3 4 5 6
1 Extremely remote 2 3 4 5
International Code of Safety for High-Speed Craft (5*4 matrix)

Probability of occurrences:
An occurrence is a condition involving a potential lowering of the level of safety. The HSC Code
distinguishes five categories of probability of occurrence:

D.4.5.2
Table 17: HSC Code frequency levels

Category Description
Frequent Likely to occur often during the operational life of a particular craft.
Reasonably probable Unlikely to occur often but which may occur several times during the total
operational life of a particular craft.
Remote Unlikely to occur to every craft but may occur to a few craft of a type over
the total operational life of a number of craft of the same type.
Extremely remote Unlikely to occur when considering the total operational life of a number
of craft of the type, but nevertheless has to be considered as being possible
Extremely improbable So extremely remote that it should not be considered as possible to occur.
Effects:
An effect is a situation arising as a result of an occurrence. The HSC Code distinguishes four categories
of probability of effects:
Minor effect - An effect which may arise from a failure, an event, or an error which can be readily
compensated for by the operating crew; it may involve:
• a small increase in the operational duties of the crew or in their difficulty in performing their
duties; or
• a moderate degradation in handling characteristics; or
• slight modification of the permissible operating conditions.
Major effect - An effect which produces:

• a significant increase in the operational duties of the crew or in their difficulty in performing their
duties which by itself should not be outside the capability of a competent crew provided that
another major effect does not occur at the same time; or
• significant degradation in handling characteristics; or
• significant modification of the permissible operating conditions, but will not remove the
capability to complete a safe journey without demanding more than normal skill on the part of the
operating crew.
Hazardous effect - An effect which produces:

• a dangerous increase in the operational duties of the crew or in their difficulty in performing their
duties of such magnitude that they cannot reasonably be expected to cope with them and will
probably require outside assistance; or
• dangerous degradation of handling characteristics; or
• dangerous degradation of the strength of the craft; or
• marginal conditions for, or injury to, occupants; or
• an essential need for outside rescue operations.
Catastrophic effect - An effect which results in the loss of the craft and/or in fatalities.
Safety Level:
Safety level is a numerical value characterizing the relationship between craft performance represented as
horizontal single amplitude acceleration (g) and rate of acceleration (g/sec) and the severity of
acceleration-load effects on standing and sitting humans. The safety levels and the corresponding severity
of effects on passengers and safety criteria for craft performance should be as defined in Table 18.

D.4.5.2
Table 18: HSC Code safety levels

Criteria not to be
EFFECT exceeded Value COMMENT
Type of load
LEVEL 1 0.08 g and 0.20 g/s35: Elderly person will keep
MINOR EFFECT balance when holding
Max acceleration
0.20 0.15 g and 0.20 g/s: Mean person will keep
measured
Moderate g34 balance when holding
horizontally33
degradation of 0.15 g and 0.80 g/s: Sitting person will start
safety holding
LEVEL 2 0.25 g and 2.0 g/s: Max. load for mean
MAJOR EFFECT person keeping balance
Max acceleration
when holding
measured 0.35 g
Significant 0.45 g and 10 g/s: Mean person falls out of
horizontally
degradation of seat when not wearing
safety seat belts
LEVEL 3 Collision design
HAZARDOUS condition calculated
Risk of injury to passengers, safe emergency
EFFECT
operation after collision.
Max. structural
Major degradation design load, based on
1.0 g: Degradation of passenger safety
of safety vertical acc. at centre
of gravity
LEVEL 4
CATASTROPHIC Loss of craft or/and fatalities
EFFECT
Numerical values:
Where numerical probabilities are used in assessing compliance with requirements using the terms similar
to those given above, the following approximate values may be used as guidelines to assist in providing a
common point of reference. The probabilities quoted should be on an hourly or per journey basis,
depending on which is more appropriate to the assessment in question:
Table 19: Numerical probability categories

Category Numerical probability
Frequent More than 10-3
Reasonably probable 10-3 to 10-5
Remote 10-5 to 10-7
Extremely remote 10-7 to 10-9
Extremely improbable Whilst no approximate numerical probability is given for this, the figures
used should be substantially less then 10-9
33
The recording instruments used shall be such that acceleration accuracy is better than 5% of the real valve and
frequency response should be minimum 20 Hz. Antialiasing filters with maximum passband attenuation 1 ±5%
should be used.
34
IG = gravity acceleration (9.81 m/s2)
35
G-rate or jerk may be evaluated from acceleration/time curves.

D.4.5.2
Note: Different occurrences may have different acceptable probabilities; according to the severity of their
consequences (See Figure 24).
SAFETY LEVEL 1 1 1 2 3 4
EFFECT ON CRAFT Normal Nuisance Operating Emergency procedures; Large reduction in safety Deaths usually, with
AND OCCUPANTS limitations significant reduction in margins, crew loass of craft
safety margins; difficult overburden because of
for crew to cope with work-load or
adverse conditions; environmental
passenger injuries conditions; serious injury
to small number of
occupants
F.A.R. 5 EXTREMELY
PROBABILITY Probable IMPROBABLE
(REF. ONLY) IMPROBABLE
EXTREMELY
Probable IMPROBABLE
IMPROBABLE
6 REASONABLY EXTREMELY
JAR-25
FREQUENT REMOTE
PROBABILITY
PROBABLE REMOTE
-0 -1 -2 -3 -4 - -6 -7 -8 -9
10 10 10 10 10 10 10 10 10 10
CATEGORY OF MINOR MAJOR HAZARDOUS CATASTROPHIC

EFFECT
Figure 24: Probability of occurrence and severity of consequence

D.4.5.2
FAA AMS process (4*5 matrix, 3 risk levels)

Table 20: Severity definitions for FAA AMS process
Table 21: Likelihood of occurrence definitions
Assessment of risk is made by combining the severity of consequence (Table 20) with the likelihood of
occurrence (Table 21) in a risk matrix (Figure 25). Risk acceptance criteria to be used in the FAA (2000)
Acquisition Management System process are shown in Table 22.

D.4.5.2
Figure 25: Risk matrix in FAA AMS process
Table 22: Risk acceptance criteria in FAA AMS process

High Risk Unacceptable.
Tracking in the FAA Hazard Tracking System is required until the risk is
reduced and accepted.
Medium Risk Acceptable with review by the appropriate management authority.
Tracking in the FAA Hazard Tracking System is required until the risk is
accepted.
Low Risk Low risk is acceptable without review.
No further tracking of the hazard is required.
Risk-based decision-making guidelines (5*3 matrix, 3 risk levels)
The Guidelines by the United States Coast Guard’s R&D center (1998) outline a risk-based decision-
making process. If risk is to be characterized using categories in the risk assessment process, the analyst
must (1) define the likelihood and consequence categories to be used in evaluating accident scenario risk
acceptability and (2) define the level of risk associated with each likelihood and consequence category
combination.
Example criteria for frequency:

Table 23 is an example of a scheme for scoring frequencies of accident scenarios. The most applicable
score would be chosen for each scenario using the descriptions provided.

D.4.5.2
Table 23: Example frequency scheme
Example criteria for consequences:

Table 24 is an example of a scheme for estimating the effects of a specific accident scenario. The most
applicable category would be chosen for the scenario using the definitions provided.
Table 24: Example effect scheme
Example risk matrix:

The following matrix (Figure 26) provides a mechanism for assigning risk, and making risk acceptance
decisions, using a risk categorization approach. Each cell in the matrix corresponds to a specific
combination of likelihood and consequence. Thus, each cell indicates the risk of a scenario having that
combination of likelihood and consequence. Each cell in the matrix can be assigned a priority number or
some other risk descriptor, as shown in the matrix below. An organization must define the categories it
will use to score risks and, more importantly, how it will prioritize and respond to the various levels of
risk associated with cells in the matrix.

D.4.5.2
Figure 26: Example risk matrix
Guidance notes on risk assessment applications for marine, offshore oil and gas industries (4*4
matrix, 3 risk levels)36
Table 25: Consequence criteria
Table 26: Likelihood criteria
36
Source: Guidance notes on risk assessment applications for the marine and offshore oil and gas industry, ABS,
U.S.A., 2000.

D.4.5.2
Figure 27: Example risk matrix
Once assignment of consequences (Table 25) and likelihoods (Table 26) is complete, a risk matrix can be
used as a mechanism for assigning risk (and making risk acceptance decisions), using a risk
categorization approach. Each cell in the matrix corresponds to a specific combination of likelihood and
consequence and can be assigned a priority number or some other risk descriptor (as shown in Figure 27).
An organization must define the categories that it will use to score risks and, more importantly, how it
will prioritize and respond to the various levels of risks associated with cells in the matrix, see ABS
(2000).
European Standard in Railway industry (6*4 matrix, 4 risk levels)

Table 27 provides, in qualitative terms, typical categories of probability or frequency of occurrence of a
hazardous event and a description of each category for a railway system, EN 50126 (1999). The
categories, their numbers, and their numerical scaling to be applied shall be defined by the Railway
Authority, appropriate to the application under consideration.
Table 27: Frequency of occurrence of hazardous events

Category Description
Frequent Likely to occur frequently. The hazard will be continually experienced.
Probable Will occur several times. The hazard can be expected to occur often.
Occasional Likely to occur several times. The hazard can be expected to occur several times.
Remote Likely to occur sometime in the system life cycle. The hazard can be reasonably
expected to occur.
Improbable Unlikely to occur but possible. It can be assumed that the hazard may exceptionally
occur.
Incredible Extremely unlikely to occur. It can be assumed that the hazard may not occur.
Consequence analysis shall be used to estimate the likely impact. Table 28 describes typical hazard
severity levels and the consequences associated with each severity level for all railway systems. The

D.4.5.2
number of severity levels and the consequences for each severity level to be applied shall be defined by
the Railway Authority, appropriate for the application under consideration.
Table 28: Hazard severity level

Severity level Consequence to persons or environment Consequence to service
Catastrophic Fatalities and/or multiple severe injuries and/or

major damage to the environment
Critical Single fatality and/or severe injury an/or Loss of a major system
significant damage to the environment
Marginal Minor injury and/or significant threat to the Severe system(s) damage
environment
Insignificant Possible minor injury Minor system damage
Table 29 defines qualitative categories of risk and the actions to be applied against each category. The
Railway Authority shall be responsible for defining principle to be adopted and the tolerability level of a
risk and the levels that fall into the different risk categories.
Table 29: Quantitative risk categories

Risk category Actions to be applied against each category
Intolerable Shall be eliminated
Undesirable Shall only be accepted when risk reduction is impracticable and with the
agreement of the Railway Authority or the safety Regulatory Authority, as
appropriate
Tolerable Acceptable with adequate control and the agreement of the Railway Authority
Negligible Acceptance with/without any agreement
Risk evaluation shall be performed by combining the frequency of occurrence of a hazardous event with
the severity of its consequence to establish the level of risk generated by the hazardous event. Figure 28
shows an example of risk evaluation and risk reduction/controls for risk acceptance.
Risk acceptance should be based on a generally accepted principle. A number of principles are available
that may be utilised, e.g.:
• As Low As Reasonably Practicable (ALARP principle as practised in UK)
• Globalement Au Moins Aussi Bon (GAMAB principle as practised in France)
• Minimum Endogenous Mortality (MEM principle as practised in Germany)

D.4.5.2
Frequency of
occurrence of a Risk levels
hazardous event
Frequent Undesirable Intolerable Intolerable Intolerable
Probable Tolerable Undesirable Intolerable Intolerable
Occasional Tolerable Undesirable Undesirable Intolerable
Remote Negligible Tolerable Undesirable Undesirable
Improbable Negligible Negligible Tolerable Tolerable
Incredible Negligible Negligible Negligible Negligible

Insignificant Marginal Critical Catastrophic
Severity levels of hazard consequence
Figure 28: Typical example of risk evaluation and acceptance

D.4.5.2
US military standard (5*4 matrix, 4 risk levels)

Mishap probability:
Mishap probability is the probability that a mishap will occur during the planned life expectancy of the
system. It can be described in terms of potential occurrences per unit of time, events, population, items, or
activity, see US (2000). Assigning a quantitative mishap probability to a potential design or procedural
hazard is generally not possible early in the design process. At that stage, a qualitative mishap probability
may be derived from research, analysis, and evaluation of historical safety data from similar systems.
Supporting rationale for assigning a mishap probability is documented in hazard analysis reports.
Suggested qualitative mishap probability levels are shown in Table 30.
Table 30: Suggested mishap probability levels
*Definitions of descriptive words may have to be modified based on quantity of items involved.
**The expected size of the fleet or inventory should be defined prior to accomplishing an assessment of the system.
Mishap severity:
Mishap severity categories are defined to provide a qualitative measure of the most reasonable credible
mishap resulting from personnel error, environmental conditions, design inadequacies, procedural
deficiencies, or system, subsystem, or component failure or malfunction. Suggested mishap severity
categories are shown in Table 31.
The dollar values shown in this table should be established on a system by system basis depending on the
size of the system being considered to reflect the level of concern.
D.4.5.2
Table 31: Suggested mishap severity categories
Note: These mishap severity categories provide guidance to a wide variety of programs. However, adaptation to a particular
program is generally required to provide a mutual understanding between the program manager and the developer as to the
meaning of the terms used in the category definitions. Other risk assessment techniques may be used provided that the user
approves them.
Mishap risk assessment matrix:

Mishap risk classification by mishap severity and mishap probability can be performed by using a mishap
risk assessment matrix. This assessment allows one to assign a mishap risk assessment value to a hazard
based on its mishap severity and its mishap probability. This value is then often used to rank different
hazards as to their associated mishap risks. An example of a mishap risk assessment matrix is shown in
Table 32.
Table 32: Example mishap risk assessment matrix

D.4.5.2
Mishap risk categories:

Mishap risk assessment values are often used in grouping individual hazards into mishap risk categories.
Mishap risk categories are then used o generate specific action such as mandatory reporting of certain
hazards to management for action or formal acceptance of the associated mishap risk. Table 33 includes
an example listing of mishap risk categories and the associated assessment values. In the example, the
system management has determined that mishap risk assessment values 1 through 5 constitute High” risk
while values 6 through 9 constitute “Serious” risk.
Table 33: Example mishap risk categories and mishap risk acceptance levels
*Representative mishap risk acceptance levels are shown in the above table. The using organization must be consulted by
the corresponding levels of program management prior to mishap risk acceptance.
Defence standard (6*4 matrix, 4 risk levels)37

Defence standard 0056 (UK 1996) is very similar to EN 50126 (1999).
Table 34: Accident frequency category
37
Source: http://www.dstan.mod.uk/data/00/056/01000200.pdf

D.4.5.2
Table 35: Accident severity category
Table 36: Example risk classification scheme
Table 37: Risk class definition
Australia/New Zealand Standard (5*5 matrix, 4 risk levels)

The standard (Australia 1999) provides a generic guide for establishing and implementing the risk
management process involving identification, analysis, assessment, treatment and continuous risk
monitoring.

D.4.5.2
Table 38: Qualitative Measure of Likelihood

Level Descriptor Description
1 Rare, The event may occur only in exceptional circumstances;
5 yearly or less often Rare exposure to risk;
Very low probability of damage.
2 Unlikely, The event could occur at some time;
yearly to 5 yearly Infrequent exposure to risk;
Low probability of damage;
Little or no history at this site.
3 Moderate, The event should occur at some time;
monthly to yearly Regular or occasional exposure to risk;
Moderate probability of damage.
4 Likely, The event will probably occur in most circumstances;
weekly to monthly Frequent exposure to risk;
Substantial probability of damage;
Some history of occurrence.
5 Almost certain The event is expected to occur in most circumstances;
Weekly or more often Constant exposure to risk;
High probability of damage;
Clear history of occurrence.
Table 39: Qualitative Measure of Consequence or Impact

Level Descriptor Example of Description
1 Insignificant No injuries; or low financial loss; or minor delays
2 Minor First aid treatment; or medium financial loss; or minor refit/repair of
facilities needed; or minor delay caused by damage or faulty equipment.
3 Moderate Medical treatment required; or high financial loss; or internal
investigations; or major refit/repair of facilities needed.
4 Major Extensive or multiple injuries; or extended absence of one or more
employees; public/media concerns; or reputation damaged; or external
investigation; or loss of production capability; or shutdown of facility; or
major financial loss.
5 Catastrophic Death; or permanent or severe health effects for one or more employees; or
shutdown of a major facility; or public/media outrage; or ministerial
investigation; legal proceedings very likely; or huge financial loss.

D.4.5.2
Consequences
Likelihood Insignificant Minor Moderate Major Catastrophic

1 2 3 4 5
1 (rare) 1 L 2 L 3 M 4 S 5 S
2 (unlikely) 2 L 4 L 6 M 8 S 10 H
3 (moderate) 3 L 6 M 9 S 14 H 15 H
4 (likely) 4 M 8 S 12 S 16 H 20 H
5 (almost 5 S 10 S 15 H 20 H 25 H
certain)
Figure 29: Qualitative Risk Analysis Matrix
Legend:
H= high risk; detailed research and management planning required at senior levels, elimination
or substitution of hazard; re-examine the controls; detailed Safe Working Procedures (SWP)
required, including specific training; close supervision of inexperienced employees.
S= significant risk; senior management attention needed, detailed SWP required, including
training for inexperienced employees.
M= moderate risk; management responsibility must be specified, detailed SWP required,
including recommended training.
L= low risk; manage by routine procedures.
Draft ISO (6*5 matrix, 3 risk levels)

Table 40: ISO 17776 risk matrix
Example of a risk matrix – DNV internal

The following risk matrix was introduced by Skramstad et al. (2000).

D.4.5.2
SEVERITY
1 2 3 4
A M H H H
LIKELIHOOD
B M M H H
C L M M H
D L L M M
E L L L L
Figure 30: Risk Matrix
Table 41: Definition of levels of likelihood

Level Description Indicative frequency Definition
(per vessel year)
A Frequent > 0.5 Will occur frequently
B Probable 0.5 – 0.05 May occur several times
C Occasional 0.05 – 0.005 Likely to occur during lifetime
D Remote 0.005 – 0.0005 Unlikely to occur during lifetime
E Improbable 0.0005 > Event so unlikely, may never be experienced

D.4.5.2
Table 42: Definition of levels of severity

Consequence Class 1 2 3 4
Minor Major Critical Catastrophic
Human/ Crew Minor injury Serious injury One fatality Several fatalities
Personnel 3rd Party No injury Minor injury Serious injury Fatalities
Environmental Negligible Pollution Pollution Pollution

pollution reportable to reportable to reportable to
regulatory regulatory regulatory
authorities. authorities. authorities.
Minor release. Major release. Uncontrolled
No long-term Limited effect pollution. Long-
effect on on recipients. term effect on
recipients. recipients.
Material/ Company Minor damage. Damage. Major damage. Loss of vessel.
Assets Properties Possible to Required Yard repair
/ Ship repair on board. seeking port required.
and/or a longer
stay in port to
repair damage.
Downtime Negligible Downtime up to Downtime up to Downtime more
downtime. one day. one week. than one week.
Reputation Negligible or no Reputation Reputation Major public
loss of affected locally affected at interest. Loss of
reputation. (terminal, port national level. reputation in the
authorities). Noted in industry.
industry.
3rd Party No effect on 3rd Minor damage Major damage Extensive
Assets party. to 3rd party to 3rd party damage to 3rd
assets close to assets in the party assets.
the ship. Short vicinity of the Considerate
repair duration. ship. Long consequences.
repair duration.
References Annex E
ABS (2000): Guidance notes on risk assessment for marine, offshore oil and gas industries
Australia (1999): Standard AS/NZS 4360
EN 50126 (1999): European standard in Railway industry
FAA (2000): System Safety Handbook, 2000
ISO standard 17776
Skramstad, E, SU Musaeus and S Melboe (2000) ’Use of risk analysis for emergency planning of LNG
tankers’ In proceedings from Gastech i Houston 2000.
UK (1996): Defence standard 0056
US Coast Guard (1998): Guidelines on Risk-based Decision-making
US (2000): Military standard MIL-STD-882D
IMO (2002): FSA Guidelines, MSC/Circ.1023, MEPC/Circ 392

SAFEDOR D 04.05.02 2005 10 21 DNV RiskEvaluationCriteria Rev 3

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

SAFEDOR D 04.05.02 2005 10 21 DNV RiskEvaluationCriteria Rev 3

Uploaded by

Copyright:

Available Formats

S A F E D O R

Project No.: IP-516278

Instrument: Integrated Project

Risk Evaluation Criteria

Rolf Skjong, Erik Vanem and Øyvind Det Norske Veritas AS

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 1 of 117

(c) COPYRIGHT 2005 The SAFEDOR Consortium

All rights reserved.

SAFEDOR-D-4.5.2-DNV-Rev-1 2005-09-15 DRAFT

SAFEDOR-D-4.5.2-DNV-Rev-1 2005-09-29 FINAL DRAFT

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 2 of 117

Document Control Sheet

Title: Risk Evaluation Criteria

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 3 of 117

Work carried out by Approved by

Rolf Skjong, DNV Eirik Andreassen

Erik Vanem, DNV - signature on file -

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 4 of 117

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 5 of 117

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 6 of 117

1.1 Scope of risk evaluation criteria

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 7 of 117

1.2 Risk acceptance criteria

1.3 Individual versus societal risk acceptance criteria

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 9 of 117

2 Principles for establishing risk acceptance criteria for safety

2.1 Absolute probabilistic risk criteria

2.2 The ALARP principle

The definitions of GCAF and NCAF are simply:

The parameters used are:

∆Cost is the marginal cost of the Risk Control Option (RCO)

2.3 The principle of equivalency

2.4 Comparison with known hazards

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 11 of 117

2.6 Voluntary risk reduction measures

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 13 of 117

2.7 The accountability principle

2.8 The holistic principle

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 14 of 117

2.9 Acceptance criteria based on a combination of different principles

Figure 2: FN curve with two absolute probabilistic values for

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 15 of 117

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 16 of 117

3 Risk acceptance criteria for safety

3.1 Individual risk

Table 1: HSE boundaries

Table 2: Suggested criteria for target risk for new ships

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 18 of 117

3.2 Societal risk

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 19 of 117

Boundary between negligible and tolerable risk (10, 2x10-5)

Boundary between negligible and tolerable risk (10, 10-5)

Boundary between negligible and tolerable risk (10, 10-4)

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 20 of 117

Figure 4: FN curves for different tankers, shown together with

3.3 Value of preventing a fatality

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 23 of 117

3.4 Cost effectiveness in actual life saving interventions

SAFEDOR-D-4.5.2-2007-10-24-DNV-RiskEvaluationCriteria-Rev-3 page 24 of 117

Table 4: Risk control options and their cost effectiveness

RCO GCAF NCAF

3a Increasing freeboard on capsize BC; 0.5 m > 27 > 24 NCF

3b Increasing freeboard on capsize BC; 1.5 m > 80 > 77 NCF